CISA adds Linux kernel 'Fragnesia' flaw (CVE-2026-46300) to KEV

CISA added CVE-2026-46300 — a Linux kernel privilege-escalation flaw nicknamed Fragnesia — to its Known Exploited Vulnerabilities catalog on 28 October 2026. CISA's entry calls it a "Linux Kernel Missing Initialization of a Variable Vulnerability." The agency says it can be chained with two Palo Alto PAN-OS flaws to implant PHP webshells and then escalate to root.

What Fragnesia is

Fragnesia is a local privilege-escalation bug in the kernel's XFRM ESP-in-TCP path. When the kernel coalesces socket-buffer fragments, it fails to propagate a shared-fragment flag, and the kernel then treats page-cache-backed pages as safe to modify — the route to running code as root. It was publicly disclosed in May 2026 with a proof-of-concept and a kernel patch, and belongs to the "Dirty Frag" class of kernel bugs. Tenable estimates CVSS 7.8; confirmed exploitation has been demonstrated on Ubuntu, and the PoC affects major distributions running kernels built before 13 May 2026.

Note the researcher affiliation is reported inconsistently across outlets — we're leaving it out rather than attach the wrong name.

Why it's in KEV now

The flaw has been patched since May, so the KEV add isn't about a new vulnerability — it's about observed in-the-wild chaining. Per reporting at BleepingComputer citing CISA, Fragnesia is being paired with CVE-2026-109618 and CVE-2026-109619 — the Palo Alto PAN-OS remote-code-execution flaws collectively called PHP2Shell. The sequence: exploit the PAN-OS pair to land a PHP webshell, then use Fragnesia to go from the webshell's context to root on the underlying Linux host.

Dream Security analysts reported the Fragnesia-plus-PHP2Shell chain was used to breach more than two dozen servers, including three at a US government-affiliated organization. CISA did not publish details of the Fragnesia attacks themselves.

Action checklist

1. Patch the kernel. If you're on a distribution kernel built before 13 May 2026, the fix is in your vendor's updates — apply it.
2. If you run PAN-OS, patch CVE-2026-109618 and CVE-2026-109619 as the other half of this chain; those are the internet-facing entry point.
3. Hunt for PHP webshells on PAN-OS management hosts and any Linux box reachable from a compromised appliance.
4. US federal agencies are bound by the KEV remediation clock for CVE-2026-46300 — treat it as the deadline for everyone.

Context

This is the third bug in the Dirty Frag family to surface in a matter of weeks, and the pattern is the one that keeps biting: a local-only kernel privesc looks low-priority until it's bolted onto an unauthenticated edge RCE. The edge appliance gets you onto the box; the kernel bug gets you root. Patch both ends of the chain, not the scarier-looking one.