Fragnesia (CVE-2026-46300): How to Check and Patch Your Linux Server on Ubuntu, Debian, RHEL and SUSE

TL;DR: Fragnesia (CVE-2026-46300) is a Linux kernel bug that lets anyone with a local account become root. CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on Oct 28, 2026. Fixed kernels have been out since May–July 2026: Ubuntu 24.04 needs linux 6.8.0-124.124 or later, RHEL 9 needs kernel 5.14.0-687.10.1.el9_8 or later, and Debian 12 needs 6.1.174-1 or later. Install the kernel update, reboot into it, then confirm with uname -r.

What is Fragnesia (CVE-2026-46300)?

Fragnesia is a flaw in the Linux kernel’s networking code (net/core/skbuff.c). When the kernel merges network buffers, it can lose a “shared fragment” marker, and the IPsec ESP code can then decrypt data in place over page-cache memory it should never write to. Red Hat calls it “a variant of Dirty Frag” in ESP/XFRM, and Ubuntu describes it as a flaw in “the XFRM ESP-in-TCP subsystem” that lets “a local attacker … escalate privileges, or possibly escape a container.”

CISA’s KEV entry (catalog version 2026.10.30) lists it with a date added of Oct 28, 2026, and a federal due date of Oct 31, 2026. CISA’s description says: “This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.” Those two CVEs are the PHP flaws known as PHP2Shell; see our PHP2Shell coverage.

• Severity: CVSS 3.1 7.8 (High), local attack, low privileges, no user interaction (NVD and the kernel CNA). Red Hat rates it Important, Ubuntu High (“Trivial local privilege escalation”), and SUSE gives its own score of 8.8.
• Affected: Linux kernels from 3.9 until the fixed stable releases 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33 and 7.0.10, and mainline 7.1 (CVE record from the kernel CNA).

Our read: a local bug sounds minor, but on a web server “local” means any compromised website account, plugin or PHP app. CISA’s chain is exactly that path: a remote PHP bug gives a shell, then Fragnesia turns it into root. Shared hosting, CI runners and container hosts are the riskiest places to leave this unpatched.

Am I affected? Check your kernel in 60 seconds

Step 1: see which kernel you’re running

uname -r
cat /etc/os-release

uname -r shows the kernel that is running now, which is what matters. An installed update doesn’t protect you until you reboot into it. Compare the result with the table below.

Ubuntu

apt changelog linux-image-$(uname -r) | grep -m1 CVE-2026-46300
pro fix CVE-2026-46300

If the changelog line prints, the running kernel’s package includes the fix. pro fix (Ubuntu Pro client) reports whether the CVE is fixed on the machine and offers to fix it. Ubuntu’s own check is to compare uname -r with its table and list installed kernels with dpkg -l 'linux-image*' | grep ^ii.

Debian

dpkg -l 'linux-image*' | grep ^ii
apt changelog linux-image-amd64 | grep -m1 CVE-2026-46300

On a fixed system the second command prints net: skbuff: preserve shared-frag marker during coalescing (CVE-2026-46300). Use linux-image-arm64 on ARM servers.

RHEL

rpm -q --changelog kernel-core-$(uname -r) | grep -m1 CVE-2026-46300
dnf updateinfo list --cve CVE-2026-46300

If dnf updateinfo lists an advisory, a fixed kernel is available and not yet installed.

SUSE and openSUSE

zypper lp --cve=CVE-2026-46300
rpm -q --changelog kernel-default | grep -m1 CVE-2026-46300

If zypper lp lists a patch, it hasn’t been applied yet.

Fixed kernel versions by distro

All versions below are copied from each vendor’s tracker, read Nov 3, 2026. “Or later” applies to every row.

Ubuntu (package linux)

HWE and cloud kernels (Ubuntu tracker):

Ubuntu marks linux-hwe-6.14 on 24.04 as “ignored (end of life).” Our advice: if you’re on that kernel, move to the 6.17 or 7.0 HWE kernel.

Why 20.04 and 18.04 are fine: Ubuntu notes that the public exploits need the espintcp module, which first appeared in kernel 5.6, so the 5.4 and 4.15 kernels “are not affected in practice.”

Debian (package linux)

Red Hat Enterprise Linux (kernel)

More Red Hat products (AUS, TUS, SAP, OpenShift)

Product	Fixed in	Advisory
RHEL 9.2 SAP	5.14.0-284.172.1.el9_2	RHSA-2026:20593
RHEL 9.0 SAP	5.14.0-70.180.1.el9_0	RHSA-2026:19705
RHEL 8.8 TUS / SAP	4.18.0-477.143.1.el8_8	RHSA-2026:19521
RHEL 8.6 AUS / TUS / SAP	4.18.0-372.193.1.el8_6	RHSA-2026:20051
RHEL 8.4 AUS / EUS Long-Life	4.18.0-305.192.1.el8_4	RHSA-2026:20130
OpenShift 4.12–4.21	Updated RHEL CoreOS images	See Red Hat’s CVE page

Red Hat also lists kpatch live patches, for example RHSA-2026:23470 (RHEL 8) and RHSA-2026:23468 (RHEL 9.6 EUS).

SUSE and openSUSE (kernel-default)

AlmaLinux, Rocky Linux, Oracle Linux and Amazon Linux aren’t covered here. Check your vendor’s own security tracker.

How to patch Fragnesia on each distro

Our advice: install the full kernel update from your vendor, not a single cherry-picked patch. Ubuntu says the Fragnesia fixes must ship together with the Dirty Frag fix (CVE-2026-43284), and the kernel CNA also assigned CVE-2026-43503 to a second Fragnesia commit. Vendor kernel updates include all of them.

Ubuntu

sudo apt update && sudo apt full-upgrade
sudo reboot

Ubuntu’s own guidance is sudo apt update && sudo apt upgrade, then a reboot. Unattended upgrades will install the kernel within 24 hours on default setups, but Ubuntu notes “a reboot is still required.”

Debian

sudo apt update && sudo apt full-upgrade
sudo reboot

RHEL

sudo dnf update kernel
sudo reboot

To apply only the advisory for your release, use sudo dnf upgrade --advisory=RHSA-2026:19568, swapping in the advisory number from the table.

SUSE and openSUSE

sudo zypper patch --cve=CVE-2026-46300
sudo reboot

On Tumbleweed, run sudo zypper dup instead.

Reboot or livepatch?

A new kernel package does nothing until the machine boots into it, so plan a reboot.

• Red Hat: kpatch live patches are listed for some releases (RHSA-2026:23470 for RHEL 8, RHSA-2026:23468 for RHEL 9.6 EUS, and SAP-stream advisories).
• SUSE: SUSE lists released kernel-livepatch packages for SLE 15 SP7 and SLES 16.0, and SLE Live Patching packages for 12 SP5 and 15 SP4.
• Ubuntu: Ubuntu’s CVE page doesn’t say whether Livepatch covers Fragnesia. Our tip: run canonical-livepatch status to see what’s applied, but don’t skip the reboot unless Ubuntu confirms coverage.

Can’t patch today? Interim mitigation

Both Ubuntu and Red Hat publish a stopgap that blocks the IPsec ESP kernel modules. Both say the kernel update is the real fix, and Ubuntu says the mitigation is “no longer needed” once it’s installed. Warning: this breaks IPsec, including VPNs such as strongSwan.

First check whether IPsec is in use (Red Hat):

lsmod | grep -E 'esp4|esp6'

If nothing prints, block the modules. These are Red Hat’s commands, run as root:

printf 'install esp4 /bin/false\ninstall esp6 /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf
rmmod esp4 esp6 2>/dev/null; true

Ubuntu’s version also blocks rxrpc (for the other Dirty Frag bug), then runs sudo update-initramfs -u -k all and confirms with:

grep -qE '^(esp4|esp6|rxrpc) ' /proc/modules && echo "Affected modules are loaded" || echo "Affected modules are NOT loaded"

If the modules are still loaded, reboot. If you need IPsec, Red Hat offers a different option: disable unprivileged user namespaces with user.max_user_namespaces=0. Red Hat warns this “may also affect rootless containers, sandboxed browsers, and Flatpak.” Remove the mitigation after you update, by deleting the .conf file (and on Ubuntu, rerunning update-initramfs).

How to verify you’re fixed

1. Reboot, then run uname -r and compare it with the table for your distro.
2. Rerun the changelog command for your distro. It should print a line with CVE-2026-46300.
3. On SUSE, zypper lp --cve=CVE-2026-46300 should no longer list a patch. On RHEL, dnf updateinfo list --cve CVE-2026-46300 should list nothing.

Were you already hit?

CISA’s KEV entry marks Fragnesia with “forensicTriage: Yes” and tells agencies to follow its “Forensics Triage Requirements” under BOD 26-04. CISA says it can be chained with the two PHP2Shell bugs “to implant PHP webshells and run commands as root.” Our advice: if a server ran an unpatched PHP app and an unpatched kernel, treat it as possibly compromised. Look for PHP files you didn’t put there, and get help with forensics before you just patch and move on.

FAQ

Is Fragnesia remotely exploitable? Not on its own. The attack vector is local (CVSS AV:L), so an attacker needs a shell or code running on the machine first. CISA says it can be chained with remote PHP bugs to get there.

Is Ubuntu 20.04 affected? Ubuntu lists the 20.04 5.4 kernel as not affected, because the public exploits need espintcp (kernel 5.6 and later). If 20.04 runs the 5.15 HWE kernel, it is affected; update to 5.15.0-181.191~20.04.1 or later.

Do containers protect me? No. Containers share the host kernel, and Ubuntu says an attacker could “possibly escape a container.” Patch the host.

Do I need to reboot? Yes, unless a vendor live patch covers this CVE on your exact kernel. Red Hat and SUSE list live patches for some releases. Ubuntu’s page doesn’t confirm Livepatch coverage.

How is it related to Dirty Frag / CVE-2026-43284? Red Hat calls Fragnesia a variant of Dirty Frag and covers both in bulletin RHSB-2026-003. Ubuntu says the CVE-2026-43284 fix and the Fragnesia fixes must ship together. A full vendor kernel update covers both.

Sources & method

• CISA, Known Exploited Vulnerabilities catalog (JSON feed, catalog version 2026.10.30).
• NIST NVD, CVE-2026-46300.
• CVE record from the Linux kernel CNA, CVE-2026-46300, and the mainline fix f84eca5817390257cef78013d0112481c503b4a3 on kernel.org.
• Ubuntu, CVE-2026-46300 and Dirty Frag mitigations blog.
• Red Hat, CVE-2026-46300 and RHSB-2026-003.
• SUSE, CVE-2026-46300.
• Debian, security tracker CVE-2026-46300.

Related: Linux ksmbd flaw made public before the mainline fix · PHP, Plex and Nextcloud KEV roundup · Security hub · All guides

Last checked: Nov 3, 2026, 2:20 p.m. Manila (UTC+8). Method: We read each source above on Nov 3, 2026. Fixed versions are copied from the vendor trackers, and quotes are from CISA, Ubuntu and Red Hat. We ran the Debian check commands on a Debian 13 machine. The other distros’ commands come from their standard package tools and weren’t run on those distros. Text marked “Our read,” “Our tip” or “Our advice” is ours, not the vendors’. The image is an original OneSignalDesk text card. No affiliate links. How we work.