What is CVE-2026-46300?

It is a Linux kernel flaw, nicknamed Fragnesia by researchers, where a socket-buffer marker is lost during coalescing, so the IPsec ESP code can decrypt data in place over memory that is backed by the page cache. Red Hat describes it as letting a low-privileged local attacker write bytes into the page cache of read-only files and gain root.

Why does it matter for website owners?

CISA's catalog entry says the flaw can be chained with CVE-2026-109618 and CVE-2026-109619 (PHP2Shell) to implant PHP webshells and run commands as root. A web-facing PHP flaw gives an attacker a foothold, and a local kernel flaw can turn that foothold into full control of the server.

Which kernel versions fix it?

The CVE record lists fixes in 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33 and 7.0.10. Distributions backport fixes, so compare your package version with your vendor's advisory. Ubuntu lists 5.15.0-181.191 (22.04), 6.8.0-124.124 (24.04) and 7.0.0-22.22 (26.04).

Do I need to reboot after updating the kernel?

Yes. A new kernel only takes effect after a reboot unless your vendor offers live patching. Ubuntu's guidance for the related Dirty Frag fixes also says a reboot is required.

I use shared hosting. What should I do?

You cannot patch the kernel yourself. Ask your host whether it has applied the fix and rebooted, and make sure your own PHP and applications are fully updated.

Linux Kernel CVE-2026-46300 Fragnesia: Patch Now

If you run a website on your own Linux server or VPS, one more patch just moved to the top of your list. On 28 October 2026, CISA added CVE-2026-46300 to its Known Exploited Vulnerabilities (KEV) catalog, which means exploitation has been observed. The flaw has been public since May 2026 and is nicknamed Fragnesia by researchers.

The short answer

CVE-2026-46300 is a Linux kernel local privilege escalation bug. It does not let a stranger attack your server from the internet by itself. It matters because an attacker who already has a foothold, for example through a web application, can use it to reach root. CISA's entry notes it can be chained with the PHP2Shell flaws to implant PHP webshells and run commands as root. The fix is a kernel update plus a reboot.

What we know

Item	Detail
CVE	CVE-2026-46300 (Fragnesia)
Added to CISA KEV	28 October 2026
CISA due date (US federal agencies)	31 October 2026
Severity	CVSS 3.1 score 7.8 (High), local attack vector, low privileges, no user interaction
Weakness	Missing initialization of a variable (CWE-456)
Fixed upstream in	5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10
Ubuntu fixed packages	22.04: 5.15.0-181.191, 24.04: 6.8.0-124.124, 26.04: 7.0.0-22.22

The kernel's own description says a network buffer can lose a marker that flags page-cache-backed memory. The IPsec ESP code then trusts the missing marker and decrypts in place over that memory. Red Hat says a low-privileged local attacker can use this to write bytes into the page cache of read-only files and gain root, and rates it Important. We are not publishing technical exploitation steps.

CISA's KEV entry lists "Forensics Triage: Yes", which signals that systems may need checking for signs of compromise, not just patching. CISA's notes say ransomware campaign use is unknown.

Who should act today

You run a VPS, dedicated server or cloud VM for your website, store or app. This is your job.
You run PHP applications (WordPress, Laravel, custom code). The PHP2Shell chain is the reason this bug matters to you. See our PHP2Shell patch guide.
You run containers or CI runners that execute code you do not fully control. Ubuntu said of the related Dirty Frag bugs that containers can add escape scenarios.
You use shared hosting or a managed platform. You cannot patch the kernel, so ask your provider for confirmation.

Checklist

Find your kernel version with uname -r and compare it with your vendor's advisory. Do not rely only on the upstream version number, because distributions backport fixes.
Install the vendor kernel update, then reboot. Plan a short maintenance window.
Patch PHP too. A kernel fix does not replace the PHP update, and the two together close the chain CISA describes.
If you cannot update immediately: Ubuntu's guidance for the earlier, related Dirty Frag flaws blocks the esp4 and esp6 kernel modules, and a security write-up on Fragnesia suggests the same where IPsec is not needed. This breaks IPsec VPNs such as StrongSwan, so test first, and treat it as a stopgap only.
Check for signs of compromise: unexpected PHP files in upload and cache folders, new admin or SSH users, and unfamiliar scheduled jobs. If you find any, rebuild from a clean image and rotate passwords and keys.
Turn on automatic security updates and note a monthly reboot window. Our website maintenance guide covers a simple routine.

When to get help

Kernel updates on a production server can feel risky. If you have no one to patch and test, a short engagement is cheaper than a cleanup. See our website development service or contact us.