Fragnesia CVE-2026-46300 Hits KEV After PAN-OS Root Chain

Fragnesia, CVE-2026-46300, is a Linux kernel privilege escalation bug that CISA added to its Known Exploited Vulnerabilities catalog on October 28, 2026, with a three-day deadline. Dream Research found it chained with the PHP2Shell flaws to take root on 25 Palo Alto Networks PAN-OS firewall and management servers. Any Linux host running a kernel without the May 2026 fix is exposed. Patch kernels and reboot first. Where you cannot, unload the ESP modules and restrict local shell access.

What happened

The bug was disclosed in May 2026 by William Bowling of Zellic and the V12 security team, who released a working proof of concept at the same time. It was the third Linux page cache privilege escalation in about two weeks, after Copy Fail (CVE-2026-31431) and Dirty Frag (CVE-2026-43284). The kernel CNA published the CVE record on May 23, 2026, with a CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N).

For five months it looked like a local bug with a public exploit and no confirmed attacks. That changed on October 26, when Dream Research published artifacts from a live campaign. The attacker used a custom build of PHP2Shell (CVE-2026-109618 and CVE-2026-109619) to run commands as the unprivileged nobody user on the PAN-OS management web server, then used Fragnesia to become root. SELinux confined the web process, so the kernel bug was what turned code execution into full control of the device.

CISA added CVE-2026-46300 to KEV two days later, on October 28, with a due date of October 31 under BOD 26-04 and forensic triage marked as required. The KEV entry states the bug can be chained with the two PHP2Shell CVEs "to implant PHP webshells and run commands as root." Our earlier coverage of PHP2Shell and the PHP 8.2 to 8.5 fixes covers the PHP side.

Who is affected

The upstream record lists the flaw as introduced in kernel 3.9 and fixed in these stable releases: 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10, and every release from 7.1 on. Distributions backport fixes into their own kernel builds, so check vendor package versions rather than the upstream number.

Ubuntu rates the bug High priority and notes it could "possibly escape a container." Fixed Ubuntu kernels:

26.04 LTS: 7.0.0-22.22
25.10: 6.17.0-35.35
24.04 LTS: 6.8.0-124.124
22.04 LTS: 5.15.0-181.191

Ubuntu lists the main 20.04, 18.04 and 16.04 kernels as not affected. SUSE, Debian, Gentoo, AlmaLinux, CloudLinux, Amazon Linux and Red Hat Enterprise Linux all published advisories in May. Red Hat tracks it under RHSB-2026-003.

Appliances are the harder case. Dream found the attacker had built version profiles for PAN-OS 12.1 and 12.2 (both running PHP 8.0.30) and lab-tested PAN-OS 11.1 builds running PHP 7.4.33. Any appliance that ships its own Linux kernel and exposes a web interface carries the same pattern of risk, and only the vendor can ship the kernel fix.

How Fragnesia CVE-2026-46300 works

The flaw sits in socket buffer handling for the kernel's XFRM ESP-in-TCP path. When TCP receive coalescing merges buffers, it drops a marker that says some memory fragments are shared and belong to the page cache. ESP input processing then believes it can decrypt in place, and writes into memory that backs a cached copy of a file. The result is a write into the page cache of files the user can only read.

The campaign shows why that matters. Dream reports the attacker used the primitive to change the cached copy of the PAM configuration for su, so su granted root without a password. Because the change lives in the page cache rather than on disk, an on-disk integrity check of that file can come back clean. For the background, see what a Linux page cache attack is and why it bypasses file permissions.

Dream's funnel numbers give a sense of scale. Using the FOFA search engine, the attacker found about 19,000 internet-facing PAN-OS management interfaces, fingerprinted about 5,000, filtered to 240 in the United States, Japan, Taiwan and South Korea on matching versions, and rooted 24. On 22 of them it only planted a 103-byte PHP webshell at /unauth/php/change_password.php and left.

Two firewalls belonged to a US government-affiliated organization. On October 24 the attacker built an eight-port reverse SSH tunnel from one of them to domain controllers, the internal firewall management server and GlobalProtect infrastructure, persisted with a systemd service and an rc.local hook, and rooted the management server at 11:35 UTC. Dream confirmed decryption of an LDAP service account password from the device configuration and full enumeration of directory users and groups. Password spraying, backdoor accounts and SAML signing key theft were attempted, with unknown outcomes.

Dream also found Claude Code installed and an offensive tool called aiscan configured with DeepSeek and Kimi on the attacker's infrastructure. It says it has no direct evidence those tools wrote the exploits, and it tentatively suggests a Chinese nexus without naming an actor.

What to do now

Patch and reboot Linux hosts. Install your distribution's fixed kernel and reboot into it. A kernel package that is installed but not running does nothing. Use our guide to checking each host against the Fragnesia fixed kernel versions.
Use the module workaround where you cannot reboot. The vendor-recommended stopgap (the same one used for Dirty Frag) is to unload and block the esp4, esp6 and rxrpc modules. This disables IPsec ESP on that host, so do not apply it to VPN gateways that depend on it:

rmmod esp4 esp6 rxrpc
printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf

Our earlier piece on blacklisting a kernel module as a stopgap mitigation covers testing and rollback. Wiz noted that AppArmor restrictions on unprivileged user namespaces may partially mitigate exploitation, but treat that as a partial control, not a fix.

Patch PAN-OS and pull management interfaces off the internet. Unit 42 says the available PAN-OS fixes "interrupt the observed exploit chain" and that customers should "immediately remove public internet access to management interfaces." Threat ID 543004 has covered the PHP2Shell traffic for Advanced Threat Prevention customers since October 20.
Hunt on PAN-OS devices that were exposed. Look for the webshell path above, the /usr/local/lib/.panops/ directory, unexpected systemd services, rc.local changes, the iox tunneling tool and a SAML setting of validate-idp-certificate: no. Work with Palo Alto Networks support for anything that needs root on the device.
Treat the LDAP bind account as compromised on any device that was rooted, and rotate it along with other credentials stored in the configuration.

What to watch next

Watch for Palo Alto Networks to publish fixed PAN-OS versions that also address the kernel, and for other appliance vendors to confirm whether their firmware is exposed. Expect more chains like this one: an unauthenticated web bug that lands as an unprivileged user, plus a public kernel LPE to finish the job. That pattern is why appliance Linux kernel patching lags months behind is now a procurement question, not just an operations one.

Sources disagree on one point. Qualys titled its May 15 advisory as exploited in attacks, while The Hacker News reported no in-the-wild exploitation at the time. The first documented exploitation is Dream's October report.