The United States Cybersecurity and Infrastructure Security Agency (CISA) added a Linux kernel flaw, CVE-2026-46300, to its Known Exploited Vulnerabilities catalogue on 28 October 2026. The flaw, known as Fragnesia, is described as a missing initialisation of a variable in the kernel. It carries a CVSS score of 7.8, requires local access and low privileges, and affects Linux kernels with IPsec ESP modules before the stable fixes. Federal civilian agencies were given until 31 October to remediate it, while CISA encouraged all organisations to prioritise exploited catalogue entries.

Why the deadline matters

The listing matters because the flaw has been reported in a chain with separate PHP flaws. Security firm Dream reported that attackers used the PHP flaws to place web shells on 25 internet-facing firewalls on 23 and 24 October, then used Fragnesia to gain root access. According to that report, web shells were placed on 24 devices, and activity went further on two servers in a United States government-affiliated environment, including a reverse SSH tunnel and access to an internal firewall management server. That attribution and campaign detail comes from Dream’s reporting, not from CISA’s catalogue notice itself.

What to patch first

Administrators should install their distribution’s current kernel update and reboot, since a new kernel only takes effect after a restart. Where a reboot cannot happen immediately and IPsec is not in use, Ubuntu’s interim advice reported in the 28 October brief is to block the esp4, esp6 and rxrpc kernel modules from loading, then remove that block once updated. Firewall and VPN management pages should not be exposed to the internet, and any exposed server that was unpatched last week should be checked for unfamiliar PHP files, new SSH keys and unexpected outbound SSH sessions.

Sources: CISA, Carthage Electronics CVE Threat Brief.