Linux kernel 'Fragnesia' CVE-2026-46300 (ESP-in-TCP page-cache write, local root) added to CISA KEV on Oct 28, 2026 and being chained with PHP2Shell to get root on web servers. How do I patch or mitigate?

What it is: CVE-2026-46300, nicknamed Fragnesia, is a Linux kernel bug in the IPsec ESP / ESP-in-TCP receive path. A missing marker during socket buffer coalescing lets a local, unprivileged process modify the in-memory (page cache) copy of files it can only read, which turns into root. It was disclosed in May 2026 and is in the same family as the earlier Dirty Frag bug, but the Dirty Frag patches do not fix it. On October 28, 2026 CISA added it to the Known Exploited Vulnerabilities catalog, noting it is being chained with the PHP2Shell flaws (CVE-2026-109618/109619): attackers get code execution as the web server user through PHP, then use Fragnesia to become root. CISA's federal deadline is October 31. Am I affected: - Linux kernels without the May 13, 2026 fix (it touches skb_try_coalesce), on systems where the esp4/esp6 (and espintcp) modules can load. Most distribution kernels shipped them until patched; Amazon Linux reports it is not affected because it doesn't ship espintcp. - The attack needs local code execution first, so internet-facing servers running PHP, other web apps, CI runners, shared hosting and multi-tenant machines are the priority. - Check uname -r against your distribution's CVE-2026-46300 advisory (Ubuntu, Debian, RHEL/AlmaLinux/Rocky, SUSE all track it); lsmod | grep -E 'esp4|esp6|espintcp' shows whether the modules are loaded. Fix: 1. Install your distribution's kernel update that lists CVE-2026-46300 and reboot (or apply a vendor livepatch that covers it). Having only the Dirty Frag patch is not enough. 2. If you can't reboot yet and don't use IPsec ESP: unload and block the modules (as root: rmmod esp4 esp6 rxrpc, then add 'install esp4 /bin/false', 'install esp6 /bin/false', 'install rxrpc /bin/false' lines to a file in /etc/modprobe.d/). This breaks IPsec ESP VPN tunnels, so check first. 3. Patch PHP too (8.2.35, 8.3.36, 8.4.27, 8.5.12 or later) so the first step of the known chain is closed. 4. If an unpatched PHP server was internet-facing, assume it may be compromised: CISA requires forensic triage for this entry. Look for web shells in the web root, new accounts, SSH keys and cron jobs; rebuild if you find signs. A reboot clears the in-memory file changes but not anything the attacker installed as root. Verify: uname -r shows the fixed kernel after reboot (or the livepatch status lists the CVE), and modprobe esp4 fails if you used the blocklist. Sources: https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://nvd.nist.gov/vuln/detail/CVE-2026-46300 https://www.tenable.com/blog/fragnesia-cve-2026-46300-faq-about-new-linux-kernel-xfrm-esp-in-tcp-priv-esc https://git.kernel.org/stable/c/3599e6b3cc1ada96883d496a50a210d3afbb6987