Skip to contentistheinternetok
All incidents

Security flaw·Major

Linux kernel flaw lets any user become root

Fix availableAttackers already use itAffects website owners
Linux kernel

What it changes for you

Nothing visible for you; server owners must update.

A flaw in the Linux kernel, nicknamed Fragnesia, lets someone who can already run code on a server take full control of it. CISA now says attackers use it, together with the PHP2Shell flaws, to plant a hidden backdoor on web servers and run commands as root. The fix has been out since May.

Started May 14, 2026Updated Oct 28, 2026

Post on X

What should I do?

You
Nothing to do. Keep your devices updated.
If you run a website or an app
Install your distribution's latest kernel update and reboot, or run a stable kernel at or above 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33 or 7.0.10. Also update PHP if you run it (see the PHP2Shell incident). Until then, unloading the esp4 and esp6 modules reduces exposure if you do not use IPsec.

What is affected

CVE-2026-46300Severity score 7.8 out of 10

Timeline

  1. Fix available · Oct 28, 2026

    CISA adds CVE-2026-46300 to its Known Exploited Vulnerabilities catalogue and says it can be chained with the two PHP flaws to plant PHP webshells and run commands as root.

    CISA

  2. Fix available · May 23, 2026

    Fixes are published for every maintained kernel branch (for example 6.12.91, 6.6.141, 5.15.208), and distributions ship patched kernels.

    OSV

  3. Identified · May 14, 2026

    Fragnesia is disclosed publicly: a flaw in the kernel's IPsec ESP-in-TCP handling lets an unprivileged user overwrite read-only files in memory and gain root. A public exploit follows.

    Rapid7

Sources

Related