Fragnesia: boot a kernel that fixes CVE-2026-46300
CISA added the Linux kernel flaw CVE-2026-46300 to the exploited catalog on 28 October 2026. Reporting describes it being used after a PHP foothold to run commands as root.
CVE-2026-46300 is a local bug in the Linux kernel, nicknamed Fragnesia in the October 2026 reporting. NVD scores it 7.8. It is not a remote worm by itself. The urgency comes from where it showed up: on hosts that were already broken into.
CISA added it to the Known Exploited Vulnerabilities catalog on 28 October 2026, with a federal due date of 31 October, and marked it for forensic triage.
What the kernel bug changes
Public descriptions say that when the kernel merges network buffers it drops a marker that a fragment is shared. Later processing can then write into pages that were only supposed to be read. The weakness is tracked as CWE-456. The practical result named by CISA is privilege escalation.
This note stops at that description. The patch is a kernel update. Reproducing the bug is not useful to the person who has to schedule the reboot.
Why it showed up next to PHP2Shell
CISA's listing says the flaw is being chained with CVE-2026-109618 and CVE-2026-109619, the PHP2Shell bugs, to plant a PHP web shell and then run commands as root. A report covered on 29 October described that chain on firewalls whose PHP was 8.0.30, a branch PHP no longer patches.
The order matters for the backlog. A host that is still on an unfixed PHP is the one where this kernel bug becomes a second step. Patching only the kernel leaves the front door. Patching only PHP leaves a local step if something else gets a shell.
Which machines need the reboot
Any Linux host on a kernel that does not contain the fix, especially ones that expose PHP or any other remote service. Appliances and firewalls are in the reporting, not only general-purpose servers. A vendor image that pins an old kernel does not move when the distribution does.
Federal civilian agencies were given 31 October 2026. That date is a useful outside bound for everyone else who had the box on the internet this week.
Install the fixed kernel and boot it
Take the kernel from your distribution's security update, install it, and reboot into it. Confirm the running version with the tool you already trust, not with the package list of a host you have not restarted. A package installed and a kernel running are different facts.
On the hosts named in the chain, also move PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and treat a web shell found after the fact as an incident: preserve logs, rotate credentials the process could read, and rebuild rather than cleaning files in place if you cannot account for every change.
Reporting on the CISA KEV entry for CVE-2026-46300, 29 October 2026, and the NVD record.
https://nvd.nist.gov/vuln/detail/CVE-2026-46300
Frequently asked questions
Is Fragnesia remote, like the PHP bugs?
No. CVE-2026-46300 is local. The reports describe it as the second step after a PHP2Shell foothold, which is the remote part. Both still need a patch.
Does installing the package finish the job?
Not until the machine boots that kernel. Check the version that is running after the reboot, not only the package database.
What is the CISA date?
The catalog entry was added on 28 October 2026. The due date given for US federal civilian agencies is 31 October 2026, with forensic triage.