CVE-2026-46300: Linux Kernel Root Flaw Joins CISA KEV

CISA added CVE-2026-46300, a Linux kernel flaw nicknamed Fragnesia, to its Known Exploited Vulnerabilities catalog on October 28, 2026, with a federal due date of October 31, according to VulnTracker. The bug has been public since May 23 and scores only 7.8, so the listing needs an explanation. CISA's entry supplies it: the flaw can be chained with the PHP2Shell vulnerabilities to implant PHP webshells and run commands as root. A Dream Research report published October 26 describes that chain in use against 25 servers.

From PHP2Shell to root on 25 servers

Dream Research says its researchers found the campaign's artifacts on October 25 and describes an operation that looks Chinese-nexus and AI-assisted but is not attributed to any named actor. Dream also says it has no direct evidence that AI tools wrote the exploit. The targets were internet-facing firewalls from a vendor that Dream and Cyber Security News do not name, only noting that the vendor has been notified. The attackers found about 19,000 devices through the FOFA search engine, got version data from about 5,000, narrowed the list to the US, Japan, Taiwan and South Korea, and queued 240 targets. In total 24 firewalls were rooted, webshells stayed on 22 of them with no further activity, and a 25th system, an internal firewall management server, was reached through a reverse SSH tunnel. Dream says two of the firewalls and the management server belonged to a US government-affiliated organization.

The chain ran in one unauthenticated request. First, a custom PHP2Shell build, not a copy of any public exploit, took over the firewall's management web server, which Dream says runs PHP 8.0.30, as the nobody user. SELinux stopped that account from changing system files, so the exploit added Fragnesia. It used a page-cache write to overwrite /etc/pam.d/su with pam_permit.so, after which su root succeeded without a password. Dream says the whole path from an unauthenticated HTTPS request to a persistent root webshell took under 15 minutes. The first firewall was rooted on October 23 at 18:14 UTC, the second on October 24 at 10:09 UTC, and the management server less than 90 minutes after that.

On the first government-linked firewall the attacker opened an eight-port reverse SSH tunnel to internal services such as LDAP, RDP to domain controllers and the VPN, then ran the same chain against the management server, which holds the configuration and credentials of every managed firewall. Dream recovered scripts for password spraying, backdoor account creation and SAML key extraction, but the report says the outcomes were not among the artifacts. Neither Dream nor Cyber Security News publishes indicators of compromise such as IP addresses or file hashes.

The kernel flaw and who is affected

Fragnesia is a local privilege escalation in the Linux network stack, tied to ESP-in-TCP handling, and Red Hat groups it with the Dirty Frag set of flaws alongside CVE-2026-43284 and CVE-2026-43500. The kernel marks buffers that hold fragments of externally owned or page-cache-backed memory with a shared-fragment flag. When the stack coalesces or moves fragments between buffers, the flag was lost. ESP input processing checks that flag before deciding whether it can decrypt in place, so it then decrypted directly over page-cache memory belonging to read-only files. Red Hat says a low-privileged local attacker can use this to write arbitrary bytes into the page cache of read-only files, overwrite privileged binaries and gain root. The score is 7.8 on CVSS 3.1, with a local vector and low privileges, set by the Linux kernel CNA and matched by NVD and Red Hat. SUSE scores it higher at 8.8 with changed scope. CISA's entry describes it as a missing initialization of a variable.

All kernels from 3.9 are affected until fixed. The upstream stable fixes are 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33 and 7.0.10, and mainline 7.1 carries it. Distributions have shipped their own builds, among them Red Hat's RHSA-2026:19568 for RHEL 9 and RHSA-2026:19569 for RHEL 10, Debian bookworm 6.1.174-1 and trixie 6.12.90-1, and Ubuntu 24.04 kernel 6.8.0-124.124 and 22.04 kernel 5.15.0-181.191. Ubuntu rates it High and calls it a trivial local privilege escalation. Debian's tracker links a public proof-of-concept repository, which we did not open.

The flaw also lives inside Siemens products. Siemens lists the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP and the SIPLUS variant, through the additional GNU/Linux subsystem in their firmware. Siemens's advisories do not agree on the fix: SSA-019113 says to update to V3.1.7, while SSA-457936 for V3.1.7 and SSA-082556 for V3.1.5 say no fix is currently available for the entries we could read. Check the current advisory for your exact order number before you rely on either.

A 7.8 gets three days when a remote bug hands it a foothold

On its own, CVE-2026-46300 does not look like a three-day item. It needs local access, scores 7.8 and has an EPSS of 10.2%. It also spent 158 days between publication on May 23 and the KEV entry on October 28, during which the major distributions shipped fixes. What moved it was the pairing. A remote code execution flaw such as PHP2Shell gives an attacker a shell as the web server user, and a local flaw turns that shell into root. CISA's entry spells out the chain, and the Dream report shows a working one.

That is how to read severity for local bugs. A local privilege escalation stays low on a list sorted by score until a public remote bug lands on the same host. Anything running PHP on a vulnerable kernel now carries both halves, and edge appliances running an old PHP branch are the clearest example. The firewall in the Dream report ran PHP 8.0.30, a branch that no longer gets updates from the PHP project.

Reading it on VulnTracker

Field	CVE-2026-46300
Title	net: skbuff: preserve shared-frag marker during coalescing
Score	7.8 High (CVSS 3.1)
EPSS	10.2%
KEV	Added Oct 28, due Oct 31
SSVC	Active, Not automatable, Total impact
CWE	787, 123, 456
Status	Undergoing analysis
Affected products	Linux Kernel, three Siemens S7-1500 CPU 1518 MFP firmware entries
Vendor advisories	50, led by Red Hat and SUSE

A few details need care. The first Linux range reads 3.9 up to and including 5.10.257, but 5.10.257 is the release that contains the fix, so read it as before 5.10.257. The Siemens entries show an affected range that stops below V3.1.7 at 60% confidence, and VulnTracker labels the V3.1.7 fix as its own inference, which fits Siemens's conflicting advisories described above. The remediation guide is empty, though the record lists eight upstream fix commits and the Red Hat and SUSE advisories that carry the packaged fixes. The title and description on VulnTracker mix two kernel commit messages, one about coalescing and one about frag-transfer helpers, which suggests the CVE spans related changes. The KEV note, which carries the PHP2Shell chaining statement, is worth reading in full on the record.

What to do before October 31

Update the kernel and reboot. Move to your distribution's fixed build, or to upstream 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33 or 7.0.10 and later. A kernel update takes effect only after a reboot or a live patch from your vendor. Ubuntu notes that its workarounds are no longer needed once the updated kernel is installed.
Use a workaround only while you wait. Red Hat offers two. Blocking the esp4 and esp6 modules removes the vulnerable path but breaks IPsec. Setting user.max_user_namespaces=0 keeps IPsec working but can affect rootless containers, sandboxed browsers and Flatpak.
Patch PHP as well. The remote half of the chain is PHP2Shell, so confirm every internet-facing server runs PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 or a vendor build with the fix, and keep session.upload_progress.enabled=0 in place until then.
Hunt on web-facing Linux hosts. Look for php-fpm, httpd or apache2 launching shells or download tools, small PHP files in public directories (Dream describes a 103-byte root webshell), unexpected systemd units or rc.local entries that open reverse SSH tunnels, and root activity that nobody started. The write targets the page cache, so a check of the file on disk may miss it. Collect process and memory evidence before you reboot.
Ask appliance vendors. Firewalls, gateways and other devices that embed PHP and a Linux kernel need both fixes, and the vendor in the Dream report has not been named. Ask each vendor for its PHP2Shell and Fragnesia status, and restrict management interfaces to trusted networks in the meantime.
Check Siemens advisories. For SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP and SIPLUS variants, read SSA-019113 and SSA-457936 for your order number, and limit interactive shell access to trusted personnel.

Takeaway

A local kernel bug that sat quietly for five months became a KEV item because a remote bug now supplies the foothold. If a host runs PHP and an affected kernel, patch both, in that order of exposure: PHP first, since it is the door, and the kernel next, since it decides whether a break-in stays a web user or becomes root. Appliances that bundle both need a vendor answer for each flaw.

To follow how the Fragnesia record changes, including its affected versions, Siemens fixes and remediation guide, track CVE-2026-46300 on VulnTracker.