Thu 5 Nov
LiveGet it free
ZOTPAPER

News without the noise

← Vulnerabilities

Fragnesia

CVE-2026-46300

Lets an attacker escalate privileges in Linux kernel

Fragnesia is a vulnerability in the Linux kernel's network socket buffer coalescing code, where the shared-frag marker is lost during packet coalescing. This breaks kernel invariants and allows an attacker to escalate privileges. The flaw affects many Linux kernel versions and is being actively exploited; CISA has added it to its Known Exploited Vulnerabilities catalog and patches have been released.

Linux · Updated 5 Nov · From 3 of our stories and the public records

Being exploitedYesAttackers are using it
CISA known exploitedListedAdded 28 Oct; US agencies must fix by 31 Oct
SeverityhighCVSS 7.8 of 10
FixAvailableFixed versions below

Am I affected?

If you run a version older than the fixed one for your line, yes.

Version lineFixed in
Linux f84eca5817390257cef78013d0112481c503b4a3f84eca5817390257cef78013d0112481c503b4a3
Linux 9d3e5fd19fe1063bf607219e8562fbd567b8e8d59d3e5fd19fe1063bf607219e8562fbd567b8e8d5
Linux 78bf6b6bb19541d19fbda6242e7cfe2c682763c078bf6b6bb19541d19fbda6242e7cfe2c682763c0
Linux 760e1addc27ba1a7beb4a0a7e8b3e9ec49e7a34e760e1addc27ba1a7beb4a0a7e8b3e9ec49e7a34e

What to do

  1. Apply the Linux kernel patches that fix the missing initialization of a variable, such as commit f84eca5817390257cef78013d0112481c503b4a3.
  2. Update your Linux kernel to a version that includes the fix for CVE-2026-46300.
  3. U.S. federal agencies must apply the patch by October 31, 2026 as directed by CISA.

What happened

  1. 28 OctCISA adds CVE-2026-46300 (Fragnesia) to its Known Exploited Vulnerabilities catalog.
  2. 29 OctCISA warns federal agencies to patch Fragnesia by October 31, 2026.
  3. 29 OctReports indicate Fragnesia is being exploited in attacks alongside PHP2Shell, targeting U.S. government servers.

The record

CVEWhat it isSeverityCISA listedExploit chance, 30 days
CVE-2026-46300net: skbuff: preserve shared-frag marker during coalescinghigh 7.828 Oct16%

Our reporting

5 NovPHP flaw hidden two years; hackers hit French blood banks, bank4 NovPHP maintainers knew of critical flaw for two years, report says29 OctCISA warns of Fragnesia Linux flaw exploited alongside PHP2Shell vulnerabilities

Reported elsewhere

www.theregister.com - Articles · 29 OctSuspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers ↗BleepingComputer · 29 OctCISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks ↗CISA · 28 OctCISA Adds Two Known Exploited Vulnerabilities to Catalog ↗

The records

CISA known-exploited catalog ↗CVE-2026-46300 on NVD ↗
Is anything you run affected?Connect Zotpaper to Claude, ChatGPT or Cursor and ask. It checks your project's packages against this vulnerability and every other one in the advisory databases, and says what to update. Your first 20 lookups are free.
Try it free