74 openlast updated

HomeOctober 2026 patch cycleCVE-2026-46300 Fragnesia: exploited Linux kernel root bug

Patch nowEnterpriseHomelabfrom 2026-10

CVE-2026-46300 Fragnesia: exploited Linux kernel root bug

Part of October 2026 patch cycle

Vendor
Linux, Debian, Ubuntu, Proxmox, Palo Alto Networks
Products
Linux kernel, Debian 11/12/13, Ubuntu 22.04/24.04/25.10/26.04, Proxmox VE kernels, PAN-OS, and Linux-based appliances
Published
· updated
Status
Open

Update, Oct 30: The appliances were Palo Alto PAN-OS firewalls and a firewall management server. Dream named the vendor in an Oct 29 update, and Palo Alto’s Unit 42 says it independently verified the attacker’s tooling and results. Unit 42 also says the PAN-OS php2shell hotfixes “interrupt the observed exploit chain” and that patched devices aren’t affected. It doesn’t say whether PAN-OS kernels carry the Fragnesia fix, and the PAN-OS advisory doesn’t mention CVE-2026-46300. So for PAN-OS, the hotfix is the fix you can install, and it’s out for every train as of Oct 29. If the management interface faced the internet, check for compromise before you count the box as done; our php2shell post lists the paths Dream found. For every other Linux-based appliance, the question to put to your vendor in writing still stands. (Dream, Unit 42, Palo Alto advisory)

Call: Patch now. Fragnesia, CVE-2026-46300, is a local privilege escalation in the Linux kernel’s ESP-in-TCP (IPsec) path. It was disclosed with a public exploit in May, and fixed kernels have been out since late May. CISA added it to KEV on Oct 28, gave federal agencies until Oct 31, and flagged it for forensic triage. What changed is that someone used it. The fix is old, so if you’ve patched your kernels since June and rebooted, you’re probably done. Check anyway, and check before you reboot.

Why now: Dream Research says an operator chained a custom php2shell exploit (CVE-2026-109618/-109619) with Fragnesia to go from an unauthenticated HTTPS request to a root webshell, in a single request, on internet-facing firewall appliances. According to artifacts Dream recovered, the operator rooted 24 of 240 targeted firewalls in the US, Japan, Taiwan and South Korea. Two of them belonged to a US government-affiliated organization. From there the operator tunneled in, rooted the internal firewall management server (number 25) on Oct 24 with the same chain, and went after Active Directory. Dream first left the firewall vendor unnamed. Its Oct 29 update names Palo Alto PAN-OS, and Unit 42 has verified the findings (see the update above). (Dream, SecurityWeek)

What it does: The kernel loses the “shared fragment” marker when it coalesces TCP buffers, so ESP decrypts in place over page-cache pages. That gives a local user a write into the in-memory copy of any readable file. Dream says the attacker used it to rewrite /etc/pam.d/su to pam_permit.so, so su root takes any password. It isn’t remote on its own. It needs code already running on the box, which is exactly what a webshell provides. In Dream’s case, SELinux kept the web server process from modifying system files, which is why the operator needed Fragnesia to finish the job.

Who’s hit: Kernels with the vulnerable ESP-in-TCP code and without the May fix. Ubuntu lists 20.04 and older as not affected on their standard kernels. The hard part is appliances: firewalls, VPN boxes, NAS and anything else running an embedded Linux kernel you can’t update yourself.

Fixed kernels (install, then reboot into it, since an installed kernel that isn’t running fixes nothing):

  • Debian: 13 trixie 6.12.90-1 (DSA-6295-1), 12 bookworm 6.1.174-1 (DSA-6306-1), 11 bullseye 5.10.257-1 (DLA-4606-1). The current trixie security kernel, 6.12.113-1, is listed fixed. (Debian)
  • Ubuntu: 26.04 7.0.0-22.22, 25.10 6.17.0-35.35, 24.04 6.8.0-124.124, 22.04 5.15.0-181.191. Cloud and HWE flavors have their own builds. (Ubuntu)
  • Proxmox VE: a Proxmox developer said in May that patched kernels 7.0.2-4, 6.17.13-9, 6.14.11-9 and 6.8.12-24 were on the test repos, and later in the enterprise repos. Anything newer carries the fix. (Proxmox forum)
  • RHEL and others: see your vendor’s CVE-2026-46300 page.
  • Appliances: ask the vendor, in writing, whether the current firmware’s kernel has the CVE-2026-46300 fix.

Before you reboot: Fragnesia changes the cached copy of a file, not the disk. A reboot or drop_caches wipes the backdoor and the evidence together. HOL suggests comparing a normal read with an O_DIRECT read of /usr/bin/su, /etc/pam.d/su and /usr/bin/sudo, and grepping /etc/pam.d/su for pam_permit. If they differ, copy the file out and treat the host as rooted. (HOL)

If you can’t reboot yet: Block the esp4, esp6 and rxrpc modules with a modprobe install ... /bin/false rule and unload them. That’s the same stopgap as for Dirty Frag in May, and it kills IPsec on that host, so don’t do it on a box that terminates your VPN tunnels.

Sources: CISA KEV alert, CISA KEV catalog, Debian, Ubuntu, Proxmox forum, HOL, Dream Research, SecurityWeek, Unit 42, Palo Alto advisory.

Sources

More from October 2026 patch cycle