Linux kernel KEV additions, August to October 2026: Fragnesia (CVE-2026-46300), ebtables, IPv6, AF_ALG and TLS local root bugs
CISA added five Linux kernel flaws to KEV between 27 Aug and 28 Oct 2026, including Fragnesia (CVE-2026-46300). Install a kernel with all five fixes and reboot.
- Published
- Updated
- Ecosystem
- Open sourceCloud
- Fixed in
- Upstream stable 6.1.177, 6.6.144, 6.12.95, 6.18.38 or 7.1.3 cover all five; distribution kernels carry their own backports
- Exploitation
- Yes. All five in CISA KEV (27 August, 18 September and 28 October 2026); CVE-2026-46300 chained with PHP2Shell per CISA and Dream
Live scores
CVE-2026-46300- EPSS
- 0.161
likely to be attacked soon - VEDAS
- 0.977
strong exploit evidence - On CISA KEV
- Yes, since 2026-10-28
- Detection rule
- Out of scope (local)
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.
VEDAS flagged this bug about 81 days before CISA confirmed attacks.
Live scores
CVE-2026-53266- EPSS
- 0.009
low predicted chance of attack - VEDAS
- 0.969
strong exploit evidence - On CISA KEV
- Yes, since 2026-09-18
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.
Live scores
CVE-2026-53362- EPSS
- 0.007
low predicted chance of attack - VEDAS
- 0.975
strong exploit evidence - On CISA KEV
- Yes, since 2026-08-27
- Detection rule
- Out of scope (local)
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.
Live scores
CVE-2025-39964- EPSS
- 0.016
some chance of attack soon - VEDAS
- 0.972
strong exploit evidence - On CISA KEV
- Yes, since 2026-09-18
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.
VEDAS flagged this bug about 20 days before CISA confirmed attacks.
Live scores
CVE-2025-39682- EPSS
- 0.033
some chance of attack soon - VEDAS
- 0.968
strong exploit evidence - On CISA KEV
- Yes, since 2026-09-18
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.
VEDAS flagged this bug about 28 days before CISA confirmed attacks.
What happened
Between August and October 2026, CISA added five Linux kernel bugs to its Known Exploited Vulnerabilities catalog. All are local: an attacker needs code running on the machine first. CISA gives no campaign details except for CVE-2026-46300 (CISA KEV).
27 August: CVE-2026-53362 (IPv6). CISA calls it a privilege escalation in the IPv6 networking subsystem that affects SUSE, Red Hat and other Linux products (CISA KEV). The kernel record says an unprivileged user can trigger an overwrite past the end of a socket buffer through a UDPv6 socket, using MSG_MORE with MSG_SPLICE_PAGES. Kernels from 6.0 are affected (CVE record).
18 September: three bugs.
- CVE-2026-53266 (ebtables SNAT). An out-of-bounds write in the ebtables SNAT target. When it rewrites the ARP sender hardware address, it can write straight into a file page imported with
splice()(CISA KEV; CVE record). - CVE-2025-39964 (AF_ALG). A race condition: concurrent writes to one
AF_ALGcrypto socket corrupt its internal state. Affects kernels from 2.6.38 (CVE record). - CVE-2025-39682 (kernel TLS). Zero-length records on the TLS receive list bypass record-type handling. Affects kernels from 6.0 (CVE record).
28 October: CVE-2026-46300, “Fragnesia”. A missing flag during socket buffer coalescing makes IPsec ESP input decrypt in place over page-cache-backed data. The kernel record traces it to 3.9 and the CISA ADP score is CVSS 7.8 (CVE record). CISA says it “can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root” (CISA KEV; CISA alert). Those are the PHP2Shell bugs; see our PHP2Shell advisory. Israeli firm Dream saw a suspected China-nexus actor use the chain to root 25 servers in the US, Japan, Taiwan and South Korea, three in a US government-affiliated environment (The Hacker News).
Fragnesia and the ebtables bug share a pattern. Per their kernel records, networking code writes into socket buffer fragments that are really pages of a file, held in the page cache or imported with splice(). That is the class of bug that lets a local user change files they can only read.
Am I affected?
Upstream stable versions that contain each fix, from the kernel CVE records:
| CVE | First fixed in stable branches | Affected from |
|---|---|---|
| CVE-2026-46300 | 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10, 7.1 | 3.9 |
| CVE-2026-53266 | 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13, 7.1 | 5.10 |
| CVE-2026-53362 | 6.1.177, 6.6.144, 6.12.95, 6.18.38, 7.1.3, 7.2 | 6.0 |
| CVE-2025-39964 | 5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49, 6.16.9, 6.17 | 2.6.38 |
| CVE-2025-39682 | 6.1.149, 6.6.103, 6.12.44, 6.16.4, 6.17 | 6.0 |
The CVE-2026-53362 record lists no fix for the 7.0 branch. CISA notes that some products affected by CVE-2026-53266 may be end of life (CISA KEV).
Distribution kernels have their own version numbers, so uname -r alone will not answer the question. Ask the package manager by CVE:
uname -r
# RHEL, Rocky, Alma, Fedora
dnf updateinfo list --cve CVE-2026-46300
# Ubuntu with the Pro client
pro fix CVE-2026-46300
# Debian: compare the running kernel with the tracker entry
# https://security-tracker.debian.org/tracker/CVE-2026-46300Repeat for each CVE. A host that installed the new kernel but has not rebooted is still running the old one. Compare uname -r with the newest installed kernel package.
What to do now
- Patch and reboot hosts where untrusted code can run first: web servers running PHP, shared hosting, CI runners, Kubernetes nodes and multi-user machines. These bugs turn any foothold, such as a web shell, into root.
- Patch PAN-OS separately. If you run Palo Alto firewalls, the Fragnesia chain starts with PHP2Shell in the management interface. Follow the PHP2Shell advisory.
- If a PHP application was compromised, assume root. Dream’s victims went from a PHP web shell to root and then to Active Directory (The Hacker News). Rebuild the host rather than removing the web shell.
- Federal agencies: CISA’s KEV entries for all five require forensic triage under BOD 26-04 in addition to patching (CISA KEV).