The US Cybersecurity and Infrastructure Security Agency has given federal civilian agencies until today, 31 October, to fix a Linux kernel vulnerability that attackers are already exploiting. The flaw, CVE-2026-46300, nicknamed Fragnesia, was added to CISA's Known Exploited Vulnerabilities catalogue on 28 October, giving agencies just three days to act. CISA also flagged the flaw for forensic triage, meaning affected organisations should check for signs of a break-in, not simply apply a patch.

The flaw carries a CVSS severity score of 7.8, rated high. It affects how the Linux kernel combines network data held in socket buffers: the skb_try_coalesce() function can transfer fragments backed by shared memory or the page cache without preserving the SKBFL_SHARED_FRAG marker. In plain terms, it is a local privilege-escalation bug — an attacker who already has a foothold on a machine can use it to gain higher privileges.

Chained with PHP flaws to reach root

What makes Fragnesia dangerous is the chain CISA describes. The agency says it can be chained with two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell, to implant PHP webshells and run commands as root. Those PHP flaws, which allow unauthenticated remote code execution, were added to the catalogue on 26 October with a 29 October deadline.

Security firm Dream attributed exploitation against 25 internet-facing firewalls on 23–24 October to a suspected China-linked group, with two used to reach a US government-affiliated network. CISA lists known ransomware campaign use of Fragnesia as unknown.

What to patch — and what not to reboot first

The fix has been available in stable kernels since late May. Fixed upstream releases include Linux 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33 and 7.0.10, while distributions carry the fix under their own version numbers — for example, Ubuntu 24.04 in 6.8.0-124.124 and Debian 12 in 6.1.174-1. Administrators must install the fixed kernel and reboot into it; a package that is installed but never booted offers no protection.

There is one caution: because Fragnesia writes into the kernel's page cache, the in-memory copy of a file, rather than touching the disk, a reboot clears both the backdoor and the evidence. Investigators advise checking memory before restarting anything, so a compromised system is not wiped clean of clues.

Sources: Cyber Security News; HOL.