Fragnesia Kernel Privilege Escalation and PHP RCE Chain

In October 2026, CISA added CVE-2026-46300 (Fragnesia) to its Known Exploited Vulnerabilities (KEV) catalog, highlighting its active exploitation in the wild. Fragnesia is a high-impact Linux kernel local privilege escalation vulnerability that allows an unprivileged user to corrupt the in-memory page cache of system binaries, such as /usr/bin/su, to execute arbitrary code with root privileges.

Technically, the vulnerability stems from a logic flaw in `skb_try_coalesce()` that fails to preserve shared-fragment flags, enabling ESP decryption to overwrite shared page cache fragments in-place. The threat is significantly amplified when chained with CVE-2026-109618 and CVE-2026-109619, two unauthenticated remote code execution flaws in PHP. This chain allows an external attacker to first gain a foothold as a web worker and immediately escalate to full system control.

While specific threat actor attribution and infrastructure remain undisclosed, the urgency is high due to the CISA KEV mandate. Affected organizations should prioritize patching Linux kernels to the May 2026 release levels and updating PHP environments to fixed versions (8.2.35+, 8.3.36+, 8.4.27+, or 8.5.12+).