Fragnesia Fixed Kernel Versions: How to Check Each Host

The Fragnesia fixed kernel versions are 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10 and anything from 7.1 on, plus each distribution's own backported builds. To check a fleet, compare the kernel each host is actually running, not just the one installed, against your vendor's fixed build for CVE-2026-46300. CISA added the bug to KEV on October 28, 2026 with a three-day deadline, so this check needs to happen now.

Which kernel versions fix Fragnesia?

Upstream, Fragnesia is fixed in stable kernels 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10 and in every release from 7.1 onward. The flaw was introduced in kernel 3.9, so older long-term branches without a fix should be treated as vulnerable.

Most servers do not run upstream kernels. Distributions take the fix and backport it into their own package versions, which often carry an older-looking version number. A Red Hat or Ubuntu kernel that reports 5.15 or 6.8 can be fully patched. Always check your vendor's advisory rather than comparing against the upstream numbers alone.

Fixed builds on Ubuntu

Ubuntu rates CVE-2026-46300 High priority. Its fixed builds of the main linux package are:

• 26.04 LTS (resolute): 7.0.0-22.22
• 25.10 (questing): 6.17.0-35.35
• 24.04 LTS (noble): 6.8.0-124.124
• 22.04 LTS (jammy): 5.15.0-181.191

Ubuntu lists the main kernels for 20.04, 18.04, 16.04 and 14.04 as not affected. The 20.04 HWE 5.15 kernel is affected and has a fix, 5.15.0-181.191~20.04.1, through Ubuntu Pro. Cloud, HWE and other kernel flavours have their own rows on the Ubuntu CVE page, so check the flavour you actually run.

For other distributions, look up CVE-2026-46300 in the vendor tracker. SUSE, Debian, Gentoo, AlmaLinux, CloudLinux, Amazon Linux and Red Hat Enterprise Linux all published advisories. Red Hat tracks it under RHSB-2026-003.

How do you check a host for the Fragnesia fix?

You check a host by reading the version of the running kernel and comparing it with the fixed build your vendor lists for that release and kernel flavour. If the running version is older, the host is vulnerable even when a newer kernel package is installed.

Work through it in this order:

1. Build the inventory. List every Linux system: physical servers, VMs, cloud instances, Kubernetes nodes, CI runners, jump hosts and developer build boxes. Shared hosts and anything that runs untrusted code, such as CI runners and container nodes, come first.
2. Record release, flavour and running version. Your configuration management, EDR or vulnerability scanner probably already collects the running kernel version. Qualys, for example, detects Fragnesia with QID 387375. Use that data instead of logging in to each box.
3. Compare against the vendor's fixed build. Mark each host as fixed, fix installed but not running, or no fix available.
4. Schedule reboots. The fix only takes effect after the host boots into the new kernel. A host that installed the update weeks ago and never rebooted is still exposed.
5. Verify after reboot. Re-collect the running version and close the item only when it matches.

Does installing the kernel update fix Fragnesia?

Installing the kernel update does not fix Fragnesia on its own. The running kernel stays vulnerable until the host reboots into the patched one, unless your vendor ships a live patch for this specific CVE.

This is where most fleets fall behind. Package reports show the fix as installed, while the uptime data shows months since the last reboot. If your organization has trouble getting reboot windows, read why the three-day KEV deadline changes how you plan kernel reboots.

Do containers need their own Fragnesia patch?

Containers do not need their own patch, because they share the host's kernel. Patching and rebooting the node fixes every container on it, and an unpatched node leaves every container exposed.

Ubuntu notes that Fragnesia could "possibly escape a container," so treat container hosts as high priority. Updating container images does nothing for this bug.

When you cannot reboot: the module workaround

For hosts that cannot reboot before the deadline, the vendor-recommended stopgap is the same one used for Dirty Frag: unload the esp4, esp6 and rxrpc modules and stop them from loading again.

rmmod esp4 esp6 rxrpc
printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf

Before you apply it:

• Check for IPsec. The ESP modules carry IPsec traffic. Blocking them breaks IPsec tunnels that terminate on that host, so leave VPN gateways to the patch-and-reboot path.
• Record it as an exception. The workaround is temporary. Remove the file once the host runs a fixed kernel so the next team does not inherit a mystery.
• Test the rollback. Our guide on how to blacklist a kernel module as a stopgap mitigation covers testing, confirming the module stays unloaded and backing the change out.

CloudLinux said customers who already applied the Dirty Frag mitigation needed no further action until patched kernels shipped. Red Hat was still assessing whether the Dirty Frag mitigations fully covered Fragnesia when it was disclosed, so check your vendor's current guidance.

Appliances are a separate list

Firewalls, VPN concentrators, storage arrays and other appliances run Linux kernels you cannot update. The October 2026 campaign that pushed Fragnesia into KEV rooted Palo Alto Networks PAN-OS devices through their management web server. Track appliances on their own list, record the vendor's statement for each, and restrict their management interfaces while you wait. The background on why this gap exists is in why appliance Linux kernel patching lags months behind.

For the attack itself, see our coverage of Fragnesia CVE-2026-46300 and the PAN-OS root chain. For why reading the disk copy of a file is not enough to rule out tampering, see what a Linux page cache attack is.