CVE-2026-46300: Linux kernel ESP-in-TCP page-cache write to root (Fragnesia)

Exploited in the wild High 7.8 EPSS 16.1% Linux kernel

skb_try_coalesce() in the kernel networking core (net/core/skbuff.c) drops the shared-fragment marker when it merges socket buffers, so the IPsec ESP receive path (ESP-in-TCP) can decrypt in place over page-cache pages of files the attacker can only read. A local unprivileged user can overwrite the cached copy of a SUID binary such as /usr/bin/su and get a root shell; Ubuntu notes it may also allow container escape. A public exploit exists, and CISA added it to KEV on 28 October 2026, noting it can be chained with the PHP flaws CVE-2026-109618 and CVE-2026-109619 to plant PHP webshells and run commands as root.

Also known as “Fragnesia”.

• CVE-2026-46300CVE identifier
• 7.8CVSS 3.1 base score (high)
• 2026-10-28added to CISA's exploited list (US federal deadline 2026-10-31)
• 16.1%EPSS: chance of exploitation in the next 30 days (higher than 97% of CVEs)
• 2026-05-23published

What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms

Affected and fixed versions

Affected:

• Linux 3.9 through 5.10.256
• Linux 5.11 through 5.15.207
• Linux 5.16 through 6.1.173
• Linux 6.2 through 6.6.140
• Linux 6.7 through 6.12.90
• Linux 6.13 through 6.18.32
• Linux 6.19 through 7.0.9

Fixed in:

• Linux 5.10.257
• Linux 5.15.208
• Linux 6.1.174
• Linux 6.6.141
• Linux 6.12.91
• Linux 6.18.33
• Linux 7.0.10
• Linux 7.1

Am I affected?

uname -r
dpkg -l 'linux-image*' | grep ^ii   # Debian/Ubuntu
rpm -q kernel   # RHEL/Fedora/Amazon/SUSE (SUSE: rpm -q kernel-default)
lsmod | grep -E 'esp4|esp6'   # loaded ESP modules = IPsec in use (Red Hat)
canonical-livepatch status --verbose   # Ubuntu Livepatch

Patch it

Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.

sudo apt update
sudo apt upgrade
sudo reboot

sudo apt update
sudo apt upgrade
sudo reboot

sudo dnf upgrade kernel
sudo reboot
# RHEL 7: sudo yum update kernel
# no-reboot option where Red Hat ships kpatch for your stream (see restart):
# sudo dnf install "kpatch-patch = $(uname -r)"

sudo dnf upgrade --refresh kernel
sudo reboot

sudo zypper refresh
sudo zypper patch --category security
sudo reboot

# Amazon Linux 2023
sudo dnf upgrade --releasever=latest 'kernel*'
# Amazon Linux 2
sudo yum update kernel
sudo reboot

sudo pacman -Syu
sudo reboot

# as root
apk update
apk upgrade
reboot

not Linux

General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.

Fix status in Linux distributions

From the Debian security tracker, Ubuntu CVE tracker and Red Hat Security Data API, refreshed every few hours.

If you cannot patch yet

• If IPsec is not used, block the ESP modules (Red Hat RHSB-2026-003; same as the Dirty Frag mitigation): printf 'install esp4 /bin/false\ninstall esp6 /bin/false\n' | sudo tee /etc/modprobe.d/dirtyfrag.conf && sudo rmmod esp4 esp6 2>/dev/null; true. On Ubuntu also run sudo update-initramfs -u -k all. This breaks IPsec VPNs (e.g. strongSwan). Remove the file to revert.
• If IPsec must keep working, Red Hat says disabling unprivileged user namespaces also blocks it: echo 'user.max_user_namespaces=0' | sudo tee /etc/sysctl.d/dirtyfrag.conf && sudo sysctl --system (breaks rootless containers, Flatpak and some browser sandboxes).
• Ubuntu says the fix must ship together with the Dirty Frag fix (CVE-2026-43284); install the full kernel update rather than cherry-picking.

Look for signs of exploitation

• The published exploit changes only the in-memory page cache of /usr/bin/su; the file on disk is untouched (V12 disclosure quoted on oss-security), so on-disk file integrity checks will not see it. Dropping caches or rebooting discards the change.

Related vulnerabilities

• CVE-2026-43284
• CVE-2026-43503
• CVE-2026-43500
• CVE-2026-109618
• CVE-2026-109619
• CVE-2026-31431

Sources

• CVE record CVE-2026-46300
• NVD CVE-2026-46300
• CISA KEV entry CVE-2026-46300
• Debian security tracker CVE-2026-46300
• Ubuntu CVE page CVE-2026-46300
• Red Hat CVE page CVE-2026-46300
• SUSE CVE page CVE-2026-46300
• Amazon Linux ALAS CVE page CVE-2026-46300
• Red Hat RHSB-2026-003 Dirty Frag / Fragnesia bulletin
• Ubuntu: Dirty Frag mitigations (same procedure for Fragnesia)
• oss-security: Fragnesia disclosure, CVE assigned
• oss-security: Dirty Frag variants fix merged
• Upstream fix (net: skbuff: preserve shared-frag marker during coalescing)
• Ubuntu Livepatch notice LSN-0122-1
• https://git.kernel.org/stable/c/3599e6b3cc1ada96883d496a50a210d3afbb6987
• https://git.kernel.org/stable/c/2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c
• https://git.kernel.org/stable/c/9d3e5fd19fe1063bf607219e8562fbd567b8e8d5
• https://git.kernel.org/stable/c/78bf6b6bb19541d19fbda6242e7cfe2c682763c0
• https://git.kernel.org/stable/c/760e1addc27ba1a7beb4a0a7e8b3e9ec49e7a34e
• https://git.kernel.org/stable/c/3bd9e113d50034db99d7ef69fd8e5242d15e414a

Page generated automatically from official sources on 2026-11-03 17:06 UTC and reviewed by an editor. Always confirm with your vendor's advisory.