--- title: "Linux Kernel Fragnesia Flaw Added to CISA KEV" description: "CISA lists the Linux kernel Fragnesia flaw as exploited. Fixed kernel builds, the PHP chain, and the governance lesson." url: https://policycortex.com/blog/fragnesia-linux-kernel-kev-chain sealed: 2026-10-29 register: blog/fragnesia-linux-kernel-kev-chain records: 3 digest: sha3:06c40164bd47200c2523238409a0d1e8a92f26f1959d458cdee6b4e48b4954cc --- # Linux Kernel Fragnesia Flaw Joins the CISA Exploited List Resources / Blog CISA lists a Linux kernel flaw as exploited. It chains with PHP flaws to reach root. Patch, reboot, and prove the running version. Leonard Esere · Sealed 2026-10-29 · Reading time 5 min Filed under: [Linux kernel](https://policycortex.com/blog/tags/linux-kernel), [Fragnesia](https://policycortex.com/blog/tags/fragnesia), [CISA KEV](https://policycortex.com/blog/tags/cisa-kev), [flaw remediation](https://policycortex.com/blog/tags/flaw-remediation), [evidence](https://policycortex.com/blog/tags/evidence) **Summary** - CISA lists a Linux kernel flaw as exploited, with a due date of October 31, 2026. - The flaw chains with PHP flaws to plant webshells and run commands as root. - Fixed kernel builds start at 5.10.257 and run through 7.1 and later. - Reboot after patching, then record the running kernel version as proof. ## What CISA listed The Cybersecurity and Infrastructure Security Agency (CISA) added a Linux kernel flaw to a catalog on October 28, 2026. The catalog is the Known Exploited Vulnerabilities (KEV) catalog. A KEV listing means CISA has evidence of active exploitation. The record is [CVE-2026-46300](https://www.cve.org/CVERecord?id=CVE-2026-46300). Common Vulnerabilities and Exposures (CVE) is the record system for public flaws. The KEV name is Linux Kernel Missing Initialization of a Variable Vulnerability. The score is 7.8 under Common Vulnerability Scoring System (CVSS) version 3.1. The weakness type is Common Weakness Enumeration (CWE) 456. ## What the flaw does The flaw fails to preserve a shared fragment marker during socket buffer coalescing. That failure can allow unintended change to page cache backed data. It can cause Encapsulating Security Payload (ESP) input processing to decrypt shared fragments in place. CISA lists a due date of October 31, 2026. Federal civilian agencies must complete forensic triage by that date under Binding Operational Directive (BOD) 26-04. CISA states ransomware campaign use is unknown. ## The chain that was reported Researchers at Dream reported a chained attack on October 28, 2026. A suspected China linked actor chained PHP2Shell with Fragnesia. The attacks hit 25 servers on October 23 and 24, 2026. The targets included systems in a United States government affiliated environment. Credential extraction and Active Directory enumeration were reported. Dream did not name a firewall vendor in this report. Do not read the 25 servers as one vendor product. Palo Alto Networks issued a separate vendor advisory. It states active exploitation has been observed for [CVE-2026-109618](https://www.cve.org/CVERecord?id=CVE-2026-109618) and [CVE-2026-109619](https://www.cve.org/CVERecord?id=CVE-2026-109619). The targets were management interfaces exposed to the internet. Risk is highest when management access is allowed from external internet addresses. The advisory says to restrict management access to trusted internal addresses. Palo Alto Networks did not link its report to the Dream report. Treat them as two separate reports about a shared chain. CISA states the flaw chains with [CVE-2026-109618](https://www.cve.org/CVERecord?id=CVE-2026-109618) and [CVE-2026-109619](https://www.cve.org/CVERecord?id=CVE-2026-109619) to plant PHP webshells and run commands as root. ## What to patch Kernel builds, fixed releases: - 5.10 line: use 5.10.257 or later. - 5.15 line: use 5.15.208 or later. - 6.1 line: use 6.1.174 or later. - 6.6 line: use 6.6.141 or later. - 6.12 line: use 6.12.91 or later. - 6.18 line: use 6.18.33 or later. - 7.0 line: use 7.0.10 or later. - 7.1 line: use 7.1 or later. Vendor and distro builds may carry their own fixed build numbers. Check the build your vendor ships, not only the upstream number. Reboot after the patch so the new kernel runs. A patched file on disk is not proof until the running kernel changes. PHP2Shell patches arrived on October 21, 2026. Use PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 for your line. The KEV due date for [CVE-2026-109618](https://www.cve.org/CVERecord?id=CVE-2026-109618) and [CVE-2026-109619](https://www.cve.org/CVERecord?id=CVE-2026-109619) falls on October 29, 2026. ## The governance lesson A kernel flaw plus a web flaw can form one path to root. Patching one half of a chain leaves the other half open. Your inventory must list every Linux host and its running kernel version. Your inventory must also list every PHP host and its PHP version. Record the version before and after each patch. Record the reboot and the scan result after the patch. A ticket marked done with no running version is a claim. PolicyCortex does not patch the kernel or PHP. PolicyCortex helps teams link proof to requirements. ## Sources - [CVE-2026-46300](https://www.cve.org/CVERecord?id=CVE-2026-46300) record, CVE Program, score 7.8, weakness CWE-456 - National Vulnerability Database (NVD) record for [CVE-2026-46300](https://nvd.nist.gov/vuln/detail/CVE-2026-46300) - [CISA alert, CISA adds two known exploited vulnerabilities to catalog](https://www.cisa.gov/news-events/alerts/2026/10/28/cisa-adds-two-known-exploited-vulnerabilities-catalog), October 28, 2026 - [CISA Known Exploited Vulnerabilities catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog), entry added October 28, 2026, due October 31, 2026 - [Palo Alto Networks advisory](https://security.paloaltonetworks.com/CVE-2026-109618) for [CVE-2026-109618](https://www.cve.org/CVERecord?id=CVE-2026-109618), active exploitation observed - [CVE-2026-109619](https://www.cve.org/CVERecord?id=CVE-2026-109619) record, CVE Program - Dream research report, October 28, 2026, chained PHP2Shell and Fragnesia attacks - Original diagram by PolicyCortex ## Next step Patch the kernel and PHP to fixed builds, reboot, and record the running versions. **Questions on this record** **Q: What is Fragnesia?** A: Fragnesia is the name for this Linux kernel flaw. **Q: Which kernel builds are fixed?** A: Fixed releases start at 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10, and 7.1. **Q: Is ransomware use confirmed?** A: No. CISA states ransomware campaign use is unknown. **Q: What is the due date?** A: The KEV due date is October 31, 2026. ## Related records Guides and articles describe the work. The evidence that work produces is described in three proof pages and one architecture page. - **proof.state**: [Proof of State](https://policycortex.com/proof/state). What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained. - **proof.change**: [Proof of Change](https://policycortex.com/proof/change). Who or what altered the environment, under what authority, with before and after state hashes. - **proof.agency**: [Proof of Agency](https://policycortex.com/proof/agency). What a machine was permitted to do before it acted, what it did, and what would have stopped it. - **architecture**: [Architecture](https://policycortex.com/architecture). How the chain is built and where it lives: inside your tenant, with no egress of evidence. ### Further reading in this register | Published | Entry | Reading | |---|---|---| | 2026-10-29 | [Veeam Backup Flaw Lets an Attacker Bypass Authorization](https://policycortex.com/blog/veeam-cdp-coordinator-authorization-bypass): Veeam fixes a 9.1 authorization bypass in Backup and Replication 13. Patch to a fixed build and record the build number. | 4 min | | 2026-10-28 | [Adobe Commerce Upload Flaw Joins the Exploited List](https://policycortex.com/blog/adobe-commerce-polyshell-kev-upload-flaw): CISA added the Adobe Commerce upload flaw to its exploited list on October 27, 2026. Stores must patch to the July 2026 build and hunt for planted code. | 4 min | | 2026-10-28 | [Jackson Databind 9.8 Flaw Bypasses Its Own Type Check](https://policycortex.com/blog/jackson-databind-98-deserialization-flaw): A new Jackson flaw scores 9.8. It bypasses a recent fix. Upgrade to a fixed build now. | 4 min | Verify the record this entry describes. [Request Access](https://app.policycortex.com/auth?mode=request-access) · [Book a call](https://policycortex.com/book) Dates of record - **Published**: 2026-10-29 - **Last updated**: Unchanged since sealing - **Author**: Leonard Esere - **Record**: https://policycortex.com/blog/fragnesia-linux-kernel-kev-chain ## Register colophon | Seq | Label | SHA3-256 | Prev | |---|---|---|---| | REC 0000 | HEAD | fbc77619cd3c | f1e99bd7deb3 | | REC 0001 | BODY | 48b1e8c53db4 | fbc77619cd3c | | REC 0002 | RELATED RECORDS | 06c40164bd47 | 48b1e8c53db4 | Head sha3:06c40164bd47200c2523238409a0d1e8a92f26f1959d458cdee6b4e48b4954cc. Each digest is SHA3-256 over the previous digest, the register key, the record label, and the record copy; a second party can recompute it from this document.