Fragnesia Linux kernel flaw gives attackers root, chained with PHP2Shell (CVE-2026-46300)

3 November 2026High 7.8Being exploited

Linux · Linux kernel · CVE-2026-46300

Fragnesia Linux kernel flaw gives attackers root, chained with PHP2Shell

A logic bug in the Linux kernel's ESP-in-TCP networking code, nicknamed Fragnesia, lets someone who can already run code on a server become root. CISA added it to its Known Exploited Vulnerabilities list on 28 October and says it can be chained with the PHP2Shell flaws to plant web shells and run commands as root. Dream Security reports a campaign that rooted 25 servers this way, and a public proof of concept exists.

Affected: Linux kernels before the fixed releases listed by NVD: 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33 and 7.0.10 (and 5.10.257 and earlier on the 5.10 line). Distributions backport fixes, so check your vendor's advisory. Most relevant to web servers and shared hosting running PHP.
What to do: Install your distribution's latest kernel update and reboot, as Red Hat, Ubuntu, Debian and others have issued fixes. Also apply the PHP updates for PHP2Shell (CVE-2026-109618 and CVE-2026-109619, see our separate entry), since that is how attackers get the first foothold. CISA's guidance is to apply vendor mitigations or stop using the product if none are available.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.
Why it’s here: On CISA's KEV list; used in real attacks together with PHP2Shell; affects the Linux servers that run many business websites.

Fragnesia Linux kernel flaw gives attackers root, chained with PHP2Shell

Affected

Linux kernels before the fixed releases listed by NVD: 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33 and 7.0.10 (and 5.10.257 and earlier on the 5.10 line). Distributions backport fixes, so check your vendor's advisory. Most relevant to web servers and shared hosting running PHP.

What to do

Install your distribution's latest kernel update and reboot, as Red Hat, Ubuntu, Debian and others have issued fixes. Also apply the PHP updates for PHP2Shell (CVE-2026-109618 and CVE-2026-109619, see our separate entry), since that is how attackers get the first foothold. CISA's guidance is to apply vendor mitigations or stop using the product if none are available.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.

Why it’s here

On CISA's KEV list; used in real attacks together with PHP2Shell; affects the Linux servers that run many business websites.