CVE-2026-46300: Linux Kernel Fragnesia Hits CISA KEV - 3-Day Clock, Chains With PHP2Shell

CVE-2026-46300 is a missing-initialization bug (CWE-456 in CISA; NVD Primary CWE-787) in the Linux kernel socket-buffer path. CISA added it to KEV on 28 October 2026. Federal due date 31 October 2026 - three calendar days. Ransomware-campaign flag: Unknown. NVD CVSS 3.1 7.8 HIGH (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Ubuntu names it Fragnesia and scores the same 7.8, priority high. Red Hat: Important, same vector.[1][2][3][5][8]

CISA’s KEV short description says this ID can be chained with PHP2Shell (CVE-2026-109618 and CVE-2026-109619) to implant PHP webshells and run commands as root. That is CISA’s wording, not a lab we ran. Patch PHP and the kernel. The PHP floor is still 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 from 21 October.[2]

If you run Linux hypervisors, shared hosting, or IPsec on a public box, this is the KEV, the version floor, and what to look at after you reboot.

What it is

The kernel commit subject is net: skbuff: preserve shared-frag marker during coalescing (stable backport 3599e6b3cc1ada96883d496a50a210d3afbb6987, upstream f84eca5817390257cef78013d0112481c503b4a3). Author on the stable commit: William Bowling. Date on that object: 13 May 2026; Greg Kroah-Hartman committed it to stable 23 May 2026 - the same day NVD published the ID.[4][3]

What the commit says, in operator English:

skb_try_coalesce() can attach paged fragments from one socket buffer onto another. If the source buffer had SKBFL_SHARED_FRAG set (page-cache-backed or otherwise not exclusively owned), the merged buffer kept the pages but dropped the marker. ESP input then asked skb_has_shared_frag() before deciding whether it could decrypt in place. Marker gone → ESP decrypts over the page-cache pages. That is a write into memory the rest of the kernel still treats as file-backed.[4]

Ubuntu’s tracker: the V12 Security Fragnesia PoCs need the espintcp module. That module landed upstream in v5.6 (e27cca96cd68). Ubuntu therefore marks bionic 4.15 and focal 5.4 not-affected in practice. They also say this ID must ship with CVE-2026-43284 (Dirty Frag): 43284 is what makes SHARED_FRAG actually checked at decrypt time; 46300 is what stops the bit getting lost on the way. Shipping one without the other leaves a window. A sibling commit is also tracked as CVE-2026-43503.[5]

This is not a panel CVE and not PHP2Shell. PHP2Shell is unauthenticated RCE in PHP. This ID is local (AV:L, PR:L) in the kernel. CISA’s chain claim is: PHP2Shell gets you the web user; this bug is how that user becomes root. We did not re-test that chain.

How serious

CISA listing it on KEV means they have evidence of active exploitation. NVD SSVC (CISA Coordinator, timestamp 2026-10-28T19:50:15Z): exploitation: active, automatable: no, technicalImpact: total. Catalog version we fetched: 2026.10.28, 1762 entries, dateReleased 2026-10-28T19:00:04Z.[2][3]

The due date is 31 October. BOD 26-04 also asks whether someone used the hole before you closed it (forensics-triage flag on this KEV row). Patching without looking is not the whole action.[1][2][10]

CVSS is local 7.8, not a 9.8 network unauth RCE. Red Hat’s statement: a low-privileged local attacker can overwrite sensitive system files via XFRM ESP-in-TCP and get root; they call it Important rather than Critical because it is local.[8]

On a shared host, “local” is any customer account, any PHP worker that already ran attacker code, any container that shares the host kernel. That is why the PHP2Shell chain matters here even though this CVE is not itself a remote PHP bug.

Who is affected

NVD CPE (status Undergoing Analysis, lastModified 2026-10-28T20:17:26Z) puts vulnerable kernels from 3.9 through a set of stable floors, including below 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10, plus 7.1-rc1/rc2. Treat those as NVD’s range, not as your distro package.[3]

Ubuntu linux source (tracker JSON fetched 2026-10-29):[5]

22.04 jammy: released 5.15.0-181.191
24.04 noble: released 6.8.0-124.124
25.10 questing: released 6.17.0-35.35
26.04 resolute: released 7.0.0-22.22 (USN-8370-1, 2 June 2026)[6]
20.04 focal / 18.04 bionic generic: not-affected (no espintcp)

Debian tracker (same fetch):[7]

bookworm: 6.1.174-1 (repo already 6.1.176-1 / security 6.1.190-1)
trixie: 6.12.90-1 (DSA-6295-1 names this CVE)
forky / sid: 7.0.9-1
bullseye was not in the resolved table. DLA-4606-1 names the CVE. NVD still includes 5.10.257 as vulnerable. Do not treat uname 5.10.257 as clean.

Red Hat (hydra JSON): RHEL 8 kernel-0:4.18.0-553.125.1.el8_10 (RHSA-2026:19666, 20 May 2026); RHEL 10 kernel-0:6.12.0-211.16.1.el10_2 (RHSA-2026:19569). RHEL 6 and 7: Not affected.[8]

CloudLinux / Alma / cPanel boxes: this post does not invent a CloudLinux errata ID. Map uname -r to the RHEL clone you actually track, or to KernelCare kcarectl --patch-info.

Proxmox VE is Debian’s kernel. Use the Debian floor for that suite, then reboot the node - a running old pve-kernel is still the old kernel.

Out of scope for this CVE ID unless you have another advisory: Windows, ESXi (CISA’s other 28 Oct add is CVE-2026-41709, insufficient logging, Broadcom Low, due 11 November - different product).[1][2]

What to do now

Inventory the running kernel, not the package sitting on disk.

uname -r
. /etc/os-release; echo "$ID $VERSION_ID"
# Ubuntu / Debian
dpkg -l 'linux-image*' | awk '/^ii/{print $2,$3}'
# RHEL clones
rpm -q kernel
# livepatch, if you use it
canonical-livepatch status 2>/dev/null
kcarectl --uname 2>/dev/null
lsmod | egrep '^(esp4|esp6|espintcp|xfrm_user) '

Patch to the distro floor above, then reboot. Ubuntu livepatch notice LSN-0122-1 is on the same CVE JSON; if you livepatch, confirm the CVE is in the running patch set, do not assume the USN package version. Unattended-upgrades will pull the package; they will not reboot for you.

# Ubuntu
sudo apt update && sudo apt install --only-upgrade linux-image-generic
# Debian
sudo apt update && sudo apt install --only-upgrade linux-image-amd64
# RHEL / Alma / Rocky
sudo dnf update kernel
sudo reboot

If you cannot reboot today, Ubuntu’s Fragnesia notes point at the same module-block as Dirty Frag: prevent esp4 / esp6 (and they also block rxrpc for the sibling bug) from loading. That breaks IPsec / StrongSwan. It is a stopgap, and Ubuntu’s own blog now says prefer the kernel update. Do not copy this onto a box that terminates IPsec unless you accept the outage.[5][9]

echo "install esp4 /bin/false" | sudo tee /etc/modprobe.d/dirty-frag.conf
echo "install esp6 /bin/false" | sudo tee -a /etc/modprobe.d/dirty-frag.conf
echo "install rxrpc /bin/false" | sudo tee -a /etc/modprobe.d/dirty-frag.conf
sudo update-initramfs -u -k all
sudo rmmod esp4 esp6 rxrpc 2>/dev/null
grep -qE '^(esp4|esp6|rxrpc) ' /proc/modules && echo "still loaded - reboot" || echo "modules not loaded"

Remove that conf after the new kernel is running.

Patch PHP2Shell if you have not. Engine floors: 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. Restart php-fpm / Apache / LiteSpeed so old workers die. A WordPress plugin update does not fix PHP.
Hunt before you declare done. BOD 26-04’s forensics-triage note is the reason. Look for PHP droppers and unexpected root-owned changes, not only a new kernel package.

Versions with no clean vendor kernel

EOL Ubuntu 14.04 / 16.04 generic: Ubuntu says not-affected for this ID; they are still EOL. Upgrade the OS.
RHEL 7 / CentOS 7: Red Hat Not affected. Still EOL. Do not read that as “safe to keep on the internet.”
Custom / vendor-forked kernels (panels, appliances, old OpenVZ): there is no apt floor until that vendor says so. Isolate or replace.

How to spot a compromise

CISA did not publish IoCs for 46300. We are not inventing them.

If the PHP2Shell chain is what you are afraid of, hunt the PHP side the same way as on 21 October: new .php under uploads, web user spawning shells/curl/wget, unexpected crons, new admin users. Then look at the host: new SUID binaries, unexpected espintcp userspace, kernel taint, SSH keys dropped in /root.

Isolate first. Keep logs. We are not publishing exploit steps.

FAQ

Is there a patch? Yes, since May/June 2026 on the major distros. The new fact is CISA KEV + 31 Oct due date, not a missing USN.

Is this remote unauth RCE? NVD and Red Hat say local. CISA’s chain claim is local-after-PHP2Shell.

Do I need IPsec enabled to be hit? Ubuntu’s PoC note says the public Fragnesia PoCs need espintcp. That is Ubuntu’s statement about those PoCs, not a CISA guarantee that every exploit needs it. If the module can load, treat the box as in scope until patched.

Does livepatch count? Only if the livepatch actually contains this CVE. Check the vendor’s patch list. A livepatched host that never rebooted can still be on a vulnerable base until the CVE is in the livepatch set.

What about CVE-2026-41709? Different KEV, same day: VMware ESX insufficient logging, admin-already-required, due 11 Nov. Do not collapse it into this kernel ID.[1]

Honesty

We did not exploit this. No espintcp PoC was run.
CISA’s PHP2Shell-chain sentence is in the KEV JSON. We have no victim names, sample counts, or a CISA forensic packet.
NVD CWE is 787; CISA CWE is 456; Red Hat also records CWE-123 on NVD as Secondary. We report the labels; we do not pick a winner.
Ubuntu “not-affected” on focal/bionic is PoC/module reasoning, not “the coalescing bug is absent from 5.4.”
CloudLinux / KernelCare floors are not in this post because we did not fetch an errata ID.
Dirty Frag (CVE-2026-43284 / 43500) is related. Only 46300 is on KEV today.

Sources

[1] https://www.cisa.gov/news-events/alerts/2026/10/28/cisa-adds-two-known-exploited-vulnerabilities-catalog - CISA alert 28 Oct 2026 two KEVs [2] https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json - CISA KEV JSON catalogVersion 2026.10.28 [3] https://nvd.nist.gov/vuln/detail/CVE-2026-46300 - NVD CVE-2026-46300 [4] https://git.kernel.org/stable/c/3599e6b3cc1ada96883d496a50a210d3afbb6987 - kernel stable commit preserve shared-frag marker [5] https://ubuntu.com/security/CVE-2026-46300 - Ubuntu CVE-2026-46300 Fragnesia [6] https://ubuntu.com/security/notices/USN-8370-1 - USN-8370-1 [7] https://security-tracker.debian.org/tracker/CVE-2026-46300 - Debian tracker CVE-2026-46300 [8] https://access.redhat.com/security/cve/CVE-2026-46300 - Red Hat CVE-2026-46300 [9] https://ubuntu.com/blog/dirty-frag-linux-vulnerability-fixes-available - Ubuntu Dirty Frag mitigation blog [10] https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk - BOD 26-04