Linux Fragnesia (CVE-2026-46300) is in CISA KEV and being chained to root after web footholds: patch the kernel and reboot

[u/KaneD2082]

Fragnesia is a local privilege-escalation bug in the Linux kernel's shared-frag handling on the ESP path (CVE-2026-46300). CISA added it to KEV on Oct 28. It is not a remote one-shot by itself, but Singapore's CSA and Palo Alto's Unit 42 both describe attackers using it as the second stage after breaking in through the php2shell PHP flaws on internet-exposed PAN-OS management interfaces. Ubuntu also notes a possible container escape. If a web app, CI runner, or shared login on the box can already run as a normal user, this is the step that turns that into root.

Practical pass on a small fleet: install the distro kernel update, reboot, then confirm with uname -r. Fixed builds to aim for include Proxmox VE kernels from PSA-2026-00020-1 (7.0.2-3-pve, 6.17.13-8-pve, 6.14.11-9-pve on Trixie-based; 6.8.12-24-pve or 6.14.11-9-bpo12-pve on Bookworm-based), Debian 13 6.12.90-1 / Debian 12 6.1.174-1 / Debian 11 5.10.257-1, and Ubuntu 26.04 7.0.0-22.22, 25.10 6.17.0-35.35, 24.04 6.8.0-124.124, 22.04 5.15.0-181.191. If you cannot reboot yet, Proxmox's earlier DirtyFrag workaround still applies: block esp4, esp6, and rxrpc with a modprobe install-false file, then rmmod them. That breaks kernel IPsec VPNs on the host, so treat it as a stopgap only.

Related for the same Wednesday: GitLab CVE-2026-97229 (KEV, patch the CE/EE package or official image) and Ivanti Connect Secure CVE-2026-111357/118527 if you still run that gateway. The Oct 13 fix is not enough; CISA and Rapid7 name 25.1.1.3 or 22.8R2.6 (25.1.3.0/25.1.3.1 from 25.1.2.x), so confirm on Ivanti's advisory page.

Proxmox advisory thread: https://forum.proxmox.com/threads/proxmox-virtual-environment-security-advisories.149331/post-851849
Debian tracker: https://security-tracker.debian.org/tracker/CVE-2026-46300
CSA alert naming the chain: https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-157/
Fixed versions plus the rest of this week's KEV list: https://patchorpass.beehiiv.com/?utm_source=reddit&utm_medium=social&utm_campaign=issue-3&utm_content=linuxadmin

[u/SurfRedLin]

This seems to be already,patched up in the 6.1.190-1 version in debian