CVE-2026-46300, nicknamed Fragnesia, is a high-severity local privilege escalation flaw in the Linux kernel’s XFRM ESP-in-TCP subsystem. It allows arbitrary byte writes into the kernel page cache of read-only files, enabling attackers to overwrite kernel structures or code sections and potentially gain full root access.
The vulnerability stems from a flaw in skb_try_coalesce() where the SKBFL_SHARED_FRAG flag is not propagated during TCP fragment coalescing. This omission causes the kernel to treat shared, file-cache-backed pages as writable, enabling in-place modification of sensitive binaries in memory without altering them on disk. It is related to the Dirty Frag vulnerabilities (CVE-2026-43284, CVE-2026-43500) but requires a separate patch.
CISA added CVE-2026-46300 to its Known Exploited Vulnerabilities (KEV) Catalog on 28 October 2026. Furthermore, CISA warns that Fragnesia is used in a chained attack in combination with PHP2Shell.
See more details on: