CVE-2026-46300: May Linux kernel bug chained with PHP2Shell for root

On October 28, CISA added CVE-2026-46300 to its Known Exploited Vulnerabilities catalog with a federal remediation deadline of October 31. The bug is a Linux kernel local privilege escalation that its finder named Fragnesia. It was disclosed and fixed in May. The new development is that it turned up as the second half of a working attack chain: the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) give an attacker commands as the web server user, and Fragnesia turns that into root.

Fragnesia was disclosed and patched in May

William Bowling disclosed the flaw on May 13, 2026, with a public proof-of-concept, a week after the related "Dirty Frag" bugs (CVE-2026-43284 and CVE-2026-43500). The fault is in skb_try_coalesce(). When the kernel merges socket buffers, it drops the flag that marks a fragment as shared with the page cache, and the IPsec ESP-in-TCP code then decrypts in place over page-cache memory. An unprivileged local user can use this to write arbitrary bytes into the cached copy of a read-only file, such as a setuid binary or a PAM config, and get root. The file on disk is never modified.

NVD and Red Hat score it 7.8. Red Hat rates it Important rather than Critical because the attacker needs local code execution first. Ubuntu says it could also be used to escape a container. Published exploits need the espintcp module, which arrived in kernel 5.6, so Ubuntu lists 20.04 and older as not affected.

How the attackers chained PHP2Shell to root

Dream Research found the campaign's artifacts on October 25 and published on October 26. Palo Alto Networks' Unit 42 said on October 29 that it had independently verified the attacker's tooling and results. The targets were PAN-OS firewall management interfaces exposed to the internet. Those interfaces run PHP (8.0.30 on PAN-OS 12.1 and 12.2), and the exploit went through PHP's session upload progress handling. Dream describes the chain this way:

• Crafted multipart POST requests exhausted memory and leaked the base address of libphp.so in a cookie header.
• A second round of memory corruption pointed a destructor at PHP's system(), giving commands as nobody.
• In the same request, Fragnesia overwrote the cached copy of /etc/pam.d/su with a pam_permit.so rule, so su root asked for no password.

The first unauthenticated HTTPS request to a persistent root webshell took under 15 minutes. The operator found about 19,000 exposed firewalls, filtered them to 240 targets, and rooted 24. A reverse SSH tunnel from one of them reached an internal management server, for 25 systems in the United States, Japan, Taiwan and South Korea. Dream found Claude Code and an AI scanning platform on the attacker's infrastructure and says the attack was operator-driven, not autonomous.

Any web app bug ends at root on an unpatched kernel

Few small businesses run PAN-OS, but nearly all of them run the two components involved: PHP and a Linux kernel. Nothing in Fragnesia is specific to firewalls. On a vulnerable kernel, every route to running code as www-data, apache or nobody leads to root: an unpatched PHP build, a vulnerable WordPress plugin, a stolen SFTP password, another account on a shared server. With root, an attacker can read every site's database credentials, edit logs, and keep access after the original entry point is cleaned up.

PHP2Shell is fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older are past end of life and got no fix. The firewalls in this campaign ran 8.0.30 and 7.4.33.

Fixed kernel versions by distribution

• Upstream stable: 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10 and 7.1
• Ubuntu 22.04: 5.15.0-181.191. Ubuntu 24.04: 6.8.0-124.124. Ubuntu 26.04: 7.0.0-22.22
• Debian 11: 5.10.257-1 (DLA-4606-1). Debian 12: 6.1.174-1 (DSA-6306-1). Debian 13: 6.12.90-1 (DSA-6295-1)
• RHEL 8, 9 and 10: fixed under Red Hat bulletin RHSB-2026-003. RHEL 6 and 7 are not affected

A server that has not rebooted since mid-May is almost certainly still running a vulnerable kernel, even if the fixed package was installed months ago.

Checking the running kernel against installed packages

uname -r

# Debian and Ubuntu
dpkg -l 'linux-image*' | grep ^ii
cat /var/run/reboot-required 2>/dev/null

# RHEL, AlmaLinux, Rocky
rpm -q kernel
needs-restarting -r

If the newest installed kernel is newer than what uname -r reports, the fix is not active until you reboot.

Blocking the ESP modules until a reboot window

Red Hat and Ubuntu both document blocking the ESP modules as a stopgap. This breaks IPsec, so confirm the server does not use it first:

lsmod | grep -E 'esp4|esp6'
printf 'install esp4 /bin/false\ninstall esp6 /bin/false\n' | sudo tee /etc/modprobe.d/dirtyfrag.conf
sudo rmmod esp4 esp6 2>/dev/null

# Debian and Ubuntu: keep the block during early boot
sudo update-initramfs -u -k all

If the server needs IPsec (strongSwan or Libreswan), Red Hat's alternative is setting user.max_user_namespaces=0 in a file under /etc/sysctl.d/ and running sysctl --system. That breaks rootless containers and Flatpak. Remove either workaround once the patched kernel is running.

Evidence to collect before rebooting

The Fragnesia write exists only in the page cache, so a reboot erases it along with any trace of it. Check first:

• grep -v '^#' /etc/pam.d/su | grep pam_permit should return nothing on a stock Debian, Ubuntu or RHEL system.
• esp4, esp6 or espintcp loaded on a server that does not run IPsec.
• PHP-FPM or web server processes with a shell or su as a child.
• Unfamiliar systemd units, new lines in rc.local, and outbound SSH sessions from a web server. Dream's operator used both persistence methods for its reverse tunnel.

We reboot managed servers into new kernels on a schedule and compare uname -r to the installed package afterward, because an installed kernel update does nothing until the reboot. If any of the checks above turn up a hit, capture process lists and memory before restarting, then rebuild the server from known-good media and restore site data from a backup taken before the earliest suspicious log entry.