CVE-2026-46300CVE-2026-46300 "Fragnesia": Linux kernel page-cache write LPE chained with PHP2Shell on PAN-OS

Executive summary

CVE-2026-46300 ("Fragnesia", CVSS 3.1 7.8) is a Linux kernel local privilege escalation in net/core/skbuff.c. skb_try_coalesce() drops the SKBFL_SHARED_FRAG marker when it moves paged fragments between socket buffers, so ESP input can decrypt in place over page-cache-backed pages. An unprivileged local user can thereby overwrite the cached contents of read-only files (for example /usr/bin/su or /etc/pam.d/su) without touching the file on disk. It belongs to the Dirty Frag class (same xfrm/ESP attack surface) but has its own patch. A public proof of concept has existed since mid-May 2026.

CISA added the CVE to KEV on 2026-10-28 (federal due date 2026-10-31) and flags it for forensic triage under BOD 26-04. KEV states that it is chained with the PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root. Dream documented a campaign in which PHP2Shell gave code execution as "nobody" on internet-exposed PAN-OS management interfaces and Fragnesia then provided root; Unit 42 states it independently verified the attacker tooling. See the PHP2Shell dossier at /campaign/php2shell/.

Upstream fixes are in 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10 and 7.1. Debian, Ubuntu, Red Hat and SUSE have shipped kernel updates. On general-purpose Linux hosts the bug needs local code execution first, so priority is highest for multi-user systems, container hosts, CI runners and any appliance where a web-facing component can be compromised.

Threat assessment

On its own Fragnesia is a local bug: the CNA scoring notes it requires a local account, and on many distributions the attacker obtains CAP_NET_ADMIN by creating an unprivileged user and network namespace. The write is deterministic per the Red Hat bug and Qualys (no race condition), which makes it a reliable second stage after any initial code execution, e.g. through a web application or PHP runtime.

The in-the-wild use documented so far is the PAN-OS chain: Dream reports 24 firewalls rooted in an automated batch plus one internal management server reached through a reverse SSH tunnel, followed by LDAP credential theft and Active Directory reconnaissance. Unit 42 tracks the actor as CL-UNK-1280 per Dream; The Register and CSO describe it as suspected China-nexus, attribution is not confirmed by a government source. Because the modification lives only in the page cache, on-disk integrity checks and file hashes taken after the fact can look clean, and a reboot discards the evidence. Treat any host with confirmed web-tier compromise and an unpatched kernel as potentially root-compromised.

Timeline

1. 2026-10-29

   Unit 42 updates its PHP2Shell threat brief: independently verified the tooling of the campaign that chained PHP2Shell with a Linux kernel LPE. Source

2. 2026-10-28

   CISA adds CVE-2026-46300 to KEV (due 2026-10-31), noting the chain with CVE-2026-109618/109619 and BOD 26-04 forensic triage. Source

3. 2026-10-26

   Dream publishes its report: PHP2Shell plus Fragnesia used to root 25 PAN-OS systems in the US, Japan, Taiwan and South Korea. Source

4. 2026-10-23

   First government-affiliated PAN-OS firewall rooted in the automated batch (18:14 UTC), per Dream. Source

5. 2026-10-21

   Palo Alto Networks publishes its advisory on PHP2Shell impact on PAN-OS management interfaces. Source

6. 2026-05-23

   CVE record published by the kernel CNA with fixed stable versions 5.10.257 to 7.0.10 and 7.1. Source

7. 2026-05-15

   SUSE releases the first kernel updates; Qualys reports advisories from Debian, Ubuntu, Red Hat, SUSE and others. Source

8. 2026-05-14

   Canonical publishes fixed Ubuntu kernels and the esp4/esp6 module-block mitigation. Source

9. 2026-05-13

   Public disclosure of Fragnesia with a public PoC by the V12 security team; Red Hat opens Bugzilla 2477015. Source

Affected & exposure

Linux kernel from 3.9 (commit cef401de7be8) up to the fixed stable releases, per the CVE record: fixed in 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10 and mainline 7.1.

Debian: bullseye fixed via DLA-4606-1 / DLA-4607-1 (linux 5.10.257-1, linux-6.1 6.1.174-1~deb11u1), bookworm via DSA-6306-1 (6.1.174-1), trixie via DSA-6295-1 (6.12.90-1), sid fixed in 7.0.9-1.

Ubuntu (linux package, Canonical CVE page): 26.04 LTS 7.0.0-22.22, 25.10 6.17.0-35.35, 24.04 LTS 6.8.0-124.124, 22.04 LTS 5.15.0-181.191; older LTS releases listed as fixed under Ubuntu Pro, while Canonical's blog states 14.04-18.04 and the 5.4 kernel on 20.04 are not affected.

Red Hat: RHEL 8, 9 and 10 (including EUS/SAP/TUS streams) and OpenShift Container Platform 4.12-4.21 per Bugzilla 2477015; errata include RHSA-2026:19521, 19540, 19568, 19569, 19666 and later.

SUSE: rated Important; fixed kernels for SLES 12 SP5 through 16.0, SUSE Linux Micro 5.x/6.x and SUSE Liberty Linux, first updates released 2026-05-15 (e.g. SLES 15 SP7 kernel-default >= 6.4.0-150700.53.55.1, SLES 16.0 >= 6.12.0-160000.31.1).

Appliances: Palo Alto Networks PAN-OS 12.1 and 12.2 were rooted with this bug in the Dream campaign. Palo Alto's public PHP2Shell advisory does not mention CVE-2026-46300; check vendor guidance for any appliance built on an unpatched Linux kernel with ESP modules available.

Exploitation in the wild

Public PoC by the V12 security team (William Bowling) released around 2026-05-13/14; it overwrites the page cache of /usr/bin/su to obtain a root shell (Help Net Security, Qualys).

In-the-wild chain (Dream, published 2026-10-26, updated 2026-10-29): PHP2Shell yields code execution as "nobody" on the PAN-OS management web server; SELinux prevents file modification, so Fragnesia is used to overwrite /etc/pam.d/su in the page cache so that "su root" succeeds without a password. Both stages run in a single HTTP request; the full chain to a root webshell completes in under 15 minutes.

First government-affiliated firewall rooted on 2026-10-23 18:14 UTC, a second on 2026-10-24 10:09 UTC, followed by a persistent reverse SSH tunnel, key harvesting from the firewall file system, LDAP service account decryption, AD enumeration and password spraying (Dream).

CISA KEV (2026-10-28): known exploited, chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root; forensic triage required under BOD 26-04.

In May 2026 Microsoft reported no in-the-wild exploitation (per Help Net Security and The Hacker News); the first public exploitation evidence is the PAN-OS campaign.

Detection & hunting

The page-cache write leaves no on-disk change, so detection relies on the steps around it: unprivileged namespace and xfrm setup, ESP module loading on hosts that do not use IPsec, and su/root transitions from service accounts. The following queries describe documented artefacts and must be validated against your log sources before production use.

index=linux sourcetype IN (linux_secure, syslog) "pam_unix(su" "session opened for user root"
| rex "by (?<src_user>\S+)\(uid=(?<src_uid>\d+)\)"
| search src_user IN ("nobody","www-data","apache","nginx","httpd") OR src_uid>=60000
| stats count min(_time) as first_seen max(_time) as last_seen by host src_user src_uid
| convert ctime(first_seen) ctime(last_seen)

DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName in~ ("su","sudo")
| where InitiatingProcessAccountName in~ ("nobody","www-data","apache","nginx","httpd")
    or InitiatingProcessParentFileName has_any ("php","httpd","nginx","appweb")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessParentFileName

title: Unshare of user and network namespace by web service account
status: experimental
description: Detects unshare/clone of new user and network namespaces by web service accounts, a prerequisite step documented for Fragnesia/Dirty Frag class exploits. Requires an auditd rule for the unshare syscall.
references:
  - https://threatprotect.qualys.com/2026/05/15/linux-kernel-local-privilege-escalation-vulnerability-exploited-in-attacks-fragnesia-cve-2026-46300/
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: SYSCALL
    SYSCALL: unshare
  service_user:
    auid|contains:
      - 'nobody'
      - 'www-data'
      - 'apache'
      - 'nginx'
  condition: selection and service_user
falsepositives:
  - Sandboxing tools, browsers and container runtimes using user namespaces
level: medium
tags:
  - attack.privilege_escalation
  - attack.t1068
  - cve.2026-46300

index=linux (sourcetype=linux_audit type=KERN_MODULE OR (sourcetype=syslog process=kernel))
("esp4" OR "esp6" OR "espintcp" OR "xfrm")
| stats count values(_raw) as events by host
| lookup ipsec_hosts host OUTPUT is_ipsec
| where isnull(is_ipsec)

Mitigation

• Install the distribution kernel update that includes the fix and reboot; verify the running kernel with uname -r against the vendor tables (Debian, Ubuntu, Red Hat, SUSE).
• If patching is not possible immediately: block and unload esp4 and esp6 (Canonical; Qualys and Help Net Security also list rxrpc as in the Dirty Frag guidance), regenerate initramfs and confirm the modules are no longer loaded. This breaks IPsec, including strongSwan-based VPNs.
• After mitigating a possibly exploited host, drop the page cache or reboot so modified cached files reload from disk (Help Net Security citing CloudLinux). On suspected compromise, capture memory and volatile evidence first, because a reboot erases the page-cache modification (CSO quoting Securonix).
• Restricting unprivileged user namespaces (e.g. AppArmor restrictions) may partially mitigate according to Wiz as cited by The Hacker News; validate per distribution.
• PAN-OS: apply the fixed PAN-OS hotfixes for PHP2Shell, remove internet access to the management interface and follow the PHP2Shell dossier (/campaign/php2shell/). Rotate secrets held on affected firewalls (LDAP service accounts, HA, TLS and device keys) as recommended by Dream.
• Federal agencies: follow KEV required action and CISA BOD 26-04 forensic triage requirements before or alongside remediation.

Update log

Sources

1. CVE-2026-46300 CVE record (cvelistV5)
2. CISA Known Exploited Vulnerabilities catalog (JSON feed)
3. Ubuntu: CVE-2026-46300
4. Canonical: Fragnesia Linux vulnerability fixes available
5. Debian security tracker: CVE-2026-46300
6. SUSE: CVE-2026-46300
7. Red Hat Bugzilla 2477015 (CVE-2026-46300)
8. Dream: Chained PHP2Shell exploit roots 25 servers
9. Unit 42: Threat Brief on CVE-2026-109618 and CVE-2026-109619
10. Qualys ThreatPROTECT: Fragnesia (CVE-2026-46300)