CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Fragnesia: Linux kernel xfrm ESP-in-TCP local privilege escalation (PoC public); on CISA KEV since 2026-10-28 and chained with the PHP2Shell flaws to root firewalls (Dream Research, 2026-10-27)

cve · CVE-2026-46300

Coverage
1
first 2026-05-15 → last 2026-11-01
Latest activity
2026-10-29
CVE-2026-46300 (Fragnesia): CISA lists the Linux kernel root flaw as exploited, chained with PHP2Shell
Peak priority
high
1 high
Targets
·
no sector or region stated
Sources cited
10
9 hosts

Action items (2)

Do-now tasks recorded on the entries about CVE-2026-46300, newest first. Check the date before acting on an older one.

  • Patch CVE-2026-46300 on every Linux host that runs PHP or other internet-facing code, then on multi-tenant hosts, container nodes and CI runners: apply the distribution kernel update and reboot; until then, where IPsec is not in use, block and unload the esp4, esp6 and rxrpc modules (this breaks IPsec), and drop the page cache so a file already modified in memory reloads from disk.
    2026-05-15CVE-2026-46300
  • On any PHP web host, appliance or management server that was reachable and unpatched for the PHP2Shell flaws, look for PHP files in web-reachable directories that nobody deployed, an outbound SSH session from the host that a systemd service or an rc.local entry keeps up, and password-spray bursts against Active Directory from the host's address, because Dream Research reports a chain of the two flaws that did exactly that.
    2026-05-15CVE-2026-46300

Defender insights

What each entry about CVE-2026-46300 tells a defender to do, newest first.

2026-05-15HIGHexploitedCVE-2026-46300 (Fragnesia): CISA lists the Linux kernel root flaw as exploited, chained with PHP2Shell

Exposure · triage · detection

Story timeline

  1. 2026-05-15CVE-2026-46300, Linux kernel: local privilege escalation via xfrm ESP-in-TCP ("Fragnesia"), listed by CISA as exploited and chained with the PHP2Shell flaws to reach root, PoC public
    trending-vulnerabilitiesCVE-2026-46300 (Fragnesia): CISA lists the Linux kernel root flaw as exploited, chained with PHP2Shell

Hunting pivots

Tags
actively-exploitedcisa-kevlpepatch-availablepoc-publicvulnerabilities
ATT&CK techniques (4 across 3 tactics)

4 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.1 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • PersistenceServer Software Component: Web Shell
  • Privilege EscalationExploitation for Privilege Escalation · Escape to Host

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-05-15/cve-2026-46300-linux-kernel-local-privilege-escalation-via-x · ATT&CK page ↗

Persistence TA0003

T1505.003Server Software Component: Web Shell×1

Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.

Evidence: 2026-05-15/cve-2026-46300-linux-kernel-local-privilege-escalation-via-x · ATT&CK page ↗

Privilege Escalation TA0004

T1068Exploitation for Privilege Escalation×1

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Evidence: 2026-05-15/cve-2026-46300-linux-kernel-local-privilege-escalation-via-x · ATT&CK page ↗

T1611Escape to Host×1

Adversaries may break out of a container or virtualized environment to gain access to the underlying host. This can allow an adversary access to other containerized or virtualized resources from the host level or to the host itself. In principle, containerized / virtualized resources should provide a clear separation of application functionality and be isolated from the host environment.

Evidence: 2026-05-15/cve-2026-46300-linux-kernel-local-privilege-escalation-via-x · ATT&CK page ↗

Entries about Fragnesia: Linux kernel xfrm ESP-in-TCP local privilege escalation (PoC public); on CISA KEV since 2026-10-28 and chained with the PHP2Shell flaws to root firewalls (Dream Research, 2026-10-27) (1)

2026-05-15 · view entry permalink →

HIGHCVE-2026-46300exploitedupdatedNATOB2

CVE-2026-46300, Linux kernel: local privilege escalation via xfrm ESP-in-TCP ("Fragnesia"), listed by CISA as exploited and chained with the PHP2Shell flaws to reach root, PoC public

CVE-2026-46300 ("Fragnesia") is a local privilege escalation flaw in the Linux kernel's XFRM ESP-in-TCP subsystem. Improper handling of shared page fragments during skb coalescing lets an unprivileged local user modify read-only file contents in the kernel page cache and gain root (Wiz Research, 2026-05-13). The public exploit uses user and network namespaces to obtain CAP_NET_ADMIN inside an isolated namespace, installs a crafted ESP security association over NETLINK_XFRM and overwrites the start of /usr/bin/su in the page cache only, so the on-disk binary never changes (Wiz Research, 2026-05-13). Dirty Frag discoverer Hyunwoo Kim says the flaw was accidentally activated by the patch for CVE-2026-43284 (Help Net Security, 2026-05-14). William Bowling of Zellic.io found it with the company's AI-agentic auditing tool, and a technical explainer and proof-of-concept exploit are public (Help Net Security, 2026-05-14).

The flaw is exploitable by unprivileged local attackers (Wiz Research, 2026-05-13), and CISA's catalog entry says it can be chained with the PHP2Shell flaws to implant PHP webshells and run commands as root (CISA KEV, 2026-10-28). Risk is highest on shared Linux hosts, container clusters where the page cache is shared across the host, CI runners and build farms, and cloud services running user code (Help Net Security, 2026-05-14). Ubuntu's default AppArmor restriction on unprivileged user namespaces is a partial mitigation that forces an extra bypass (Wiz Research, 2026-05-13).

Triage: unprivileged user namespaces are routine for rootless containers, sandboxed browsers and Flatpak, and IPsec is commonly used for VPNs and site-to-site tunnels (Red Hat RHSB-2026-003, 2026-07-03), so either alone is weak; the exploit's signature is one unprivileged process tree that sets up its own ESP security association inside a fresh network namespace and then runs su (Wiz Research, 2026-05-13).

Three vulnerabilities, collectively known as "Dirty Frag", have been identified in networking subsystems of the Linux kernel, two of which affect Red Hat products.

Red Hat (RHSB-2026-003) 2026-07-03

Red Hat says CVE-2026-43500 doesn't affect its products, while CVE-2026-43284 and CVE-2026-46300 do affect supported Red Hat Enterprise Linux kernels and anything built on them.

Researchers have already published working proof-of-concept exploits for Kubernetes, and Ubuntu spells out the risk of a container escape.

Aikido Security 2026-09-04

This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.

CISA Known Exploited Vulnerabilities catalog 2026-10-28

The implementation we recovered is a custom, non-public build, not a copy of any known public exploit for PHP2Shell.

We do not attribute this activity to a named threat actor.

Dream Research 2026-10-27
Updaterun 2026-09-05T0409Z-intelupdated_atcvessummarysourcesevidenceentitiestechniquesclassificationsourcing_notebody

Red Hat rates CVE-2026-46300 CVSS 7.8 (Red Hat Product Security, 2026-05-13). Red Hat's own security bulletin groups it under the collective "Dirty Frag" name alongside CVE-2026-43284 and CVE-2026-43500, labelling it specifically "Fragnesia (skb coalescing via ESP-in-TCP)": "three vulnerabilities, collectively known as 'Dirty Frag', have been identified in networking subsystems of the Linux kernel, two of which affect Red Hat products" (Red Hat RHSB-2026-003, 2026-07-03). Applicability splits per CVE: "Red Hat says CVE-2026-43500 doesn't affect its products, while CVE-2026-43284 and CVE-2026-46300 do affect supported Red Hat Enterprise Linux kernels and anything built on them" (Aikido Security, 2026-09-04). Any RHEL, OpenShift or RHEL CoreOS estate must therefore confirm the CVE-2026-46300 fix specifically, not only the earlier two. For the Dirty Frag family as a whole (CVE-2026-43284, CVE-2026-43500 and CVE-2026-46300), Aikido writes: "Researchers have already published working proof-of-concept exploits for Kubernetes, and Ubuntu spells out the risk of a container escape"; it names no Kubernetes exploit for CVE-2026-46300 itself (Aikido Security, 2026-09-04). Because containers share the host kernel, a compromised workload that can reach the vulnerable code path (governed by seccomp, pod security and user-namespace settings) can escalate to root on the node (Aikido Security, 2026-09-04). As of 2026-09-05, no source stated confirmed in-the-wild exploitation of this specific CVE. Microsoft's previously reported limited in-the-wild activity ("privilege escalation involving 'su'") was itself stated as ambiguous between the "Dirty Frag" family and the separate, earlier "Copy Fail" vulnerability (CVE-2026-31431) (Microsoft Security Blog, 2026-05-08). That is not a distinction between the two Dirty Frag CVEs themselves, and not specific evidence of exploitation for CVE-2026-46300.

Correctionrun 2026-09-30T0639Z-auditsourcesevidencebodysourcing_noteactionsentities

The interim mitigation is corrected. Until the kernel update is deployed, block and unload the esp4, esp6 and rxrpc modules where they are not needed (Wiz Research, 2026-05-13 · Help Net Security, 2026-05-14). Blocking esp4 and esp6 breaks IPsec, and Red Hat's IPsec-preserving alternative is disabling unprivileged user namespaces (Red Hat RHSB-2026-003, 2026-07-03). At disclosure AlmaLinux and CloudLinux had shipped patched kernels (Help Net Security, 2026-05-14). The entry previously named other kernel modules, a CAP_NET_ADMIN restriction, an affected version range and wider distribution patch coverage that its sources do not state, and it wrongly described Dirty Frag discoverer Hyunwoo Kim as a Wiz researcher.

Correctionrun 2026-10-21T0800Z-audittitleheadlinesummarybody

Aikido's statement that working Kubernetes proof-of-concept exploits have been published concerns the Dirty Frag family as a whole, which it defines as CVE-2026-43284, CVE-2026-43500 and CVE-2026-46300, and its link for the container-escape risk is Ubuntu's page for CVE-2026-43284 (Aikido Security, 2026-09-04). No cited source describes a Kubernetes exploit for CVE-2026-46300 itself; its public exploit overwrites /usr/bin/su in the page cache (Help Net Security, 2026-05-14). On a host, that exploit shows as an unprivileged process creating user and network namespaces and installing an ESP security association over NETLINK_XFRM before su starts a root shell (Wiz Research, 2026-05-13).

Updaterun 2026-10-29T0255Z-inteltitleheadlinesummaryupdated_atprioritytagstechniquesentitiescvessourcesevidencesourcing_noteactionsbody

CISA added CVE-2026-46300 to its Known Exploited Vulnerabilities catalog on 2026-10-28 and says in the entry that the flaw can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root, naming no actor or victim (CISA KEV, 2026-10-28). Dream Research describes a chain of this kind from artifacts its tooling recovered: a custom, non-public PHP2Shell build, tailored to the PAN-OS management web server, which runs PHP 8.0.30, gives code execution as the nobody user, and the Fragnesia exploit then overwrites /etc/pam.d/su in the page cache so that su root succeeds without a password; Dream says SELinux confines the web server's domain from modifying system files and that the whole chain runs in one HTTP request in under 15 minutes (Dream Research, 2026-10-29). From about 19,000 internet-facing PAN-OS firewalls that it found through a search engine, the attacker narrowed to 240 in the United States, Japan, Taiwan and South Korea, rooted 24 and planted a PHP webshell on each; on the second of two firewalls of a US government-affiliated organization (the first crashed) it set up an outbound SSH tunnel kept up by a systemd service and an rc.local entry, rooted the organization's firewall management server through the tunnel, decrypted the LDAP service-account password with root access and sprayed passwords against a domain that had no lockout threshold (Dream Research, 2026-10-29). Dream says the recovered artifacts confirm credential extraction and directory enumeration but could not tell whether the password spray succeeded, calls the campaign apparently Chinese and AI-assisted and does not attribute it to a named actor (Dream Research, 2026-10-27).

Improvementrun 2026-11-01T0256Z-intelsummarysourcing_notesourcesentities

Dream Research updated its report on 2026-10-29 to say that the firewalls rooted with a custom PHP2Shell build chained to this kernel flaw run Palo Alto Networks PAN-OS, and counts 25 rooted PAN-OS firewall and management servers; Unit 42 says it independently verified the attacker's tooling and confirmed the reported results (Dream Research, 2026-10-29; Unit 42, 2026-10-29).

Correctionrun 2026-11-01T1312Z-auditbody

Dream Research's report, as updated on 2026-10-29, names the rooted firewalls as Palo Alto Networks PAN-OS and the exploited surface as the PAN-OS management web server, and says the recovered artifacts confirm credential extraction and directory enumeration in the attacked Active Directory, while whether the password spray succeeded is unknown (Dream Research, 2026-10-29). Unit 42 says the PHP flaws are exploited against PAN-OS management interfaces exposed to the internet and that customers who have applied the available PAN-OS fixes are not affected (Unit 42, 2026-10-29). CISA's catalog entry says the kernel flaw can be chained with the PHP flaws to implant PHP webshells and run commands as root; it does not itself say which flaw supplies the web-server code execution (CISA KEV, 2026-10-28).

vulnerability15 May 05:00Zmulti-sourceOpen finding →
Sources: Wiz Research, 2026-05-13 · Help Net Security, 2026-05-14 · Red Hat (RHSB-2026-003) · Red Hat Product Security · Aikido Security · FIRST.org EPSS API · Microsoft Security Blog · CISA Known Exploited Vulnerabilities catalog · Dream Research · Dream Research (report updated 2026-10-29) · Palo Alto Networks Unit 42 (threat brief, updated 2026-10-29)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • access.redhat.com2 (20%)
  • aikido.dev1 (10%)
  • api.first.org1 (10%)
  • cisa.gov1 (10%)
  • dreamgroup.com1 (10%)
  • helpnetsecurity.com1 (10%)
  • microsoft.com1 (10%)
  • unit42.paloaltonetworks.com1 (10%)
  • other1 (10%)

External references

NVD · cve.org · CISA KEV

All cited sources (10)