Linux

fragnesia: the /usr/bin/su that is clean on disk and corrupt in memory

CISA KEV-listed a Linux kernel bug called fragnesia on October 28, with a due date of October 31. Its entry names a chain with PHP2Shell that ends in an unauthenticated root shell. The catch: the exploit corrupts the in-memory copy of a system binary, so the file on disk

Glenn Fryklund

Glenn Fryklund

— 3 min read
Share
A metal computer chip engraved with the letters su on a dark workbench, with a shadow-like copy of the chip hovering above it, split open and glowing red from the crack
A system binary that is intact on disk but cracked open in the in-memory copy: fragnesia corrupts the page-cache copy of /usr/bin/su while the file on disk passes every hash check. Rendered with AI.

CISA added CVE-2026-46300 to the Known Exploited Vulnerabilities catalog on October 28. The row carries a federal due date of October 31, requires forensic triage, and includes a short description that makes it more than a patch alert: the bug "can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root."

The kernel bug is known as "fragnesia." It is a member of the Dirty Frag vulnerability class, a separate bug from the original dirtyfrag with its own patch, discovered by William Bowling with the V12 team. The public proof of concept is one line: clone, compile, run.

How a network path writes into a file's memory

The bug sits in the kernel's packet coalescing path. When the network stack merges two packets into one, skb_try_coalesce() transfers paged fragments without propagating the SKBFL_SHARED_FRAG flag. Downstream, the ESP input path checks skb_has_shared_frag() to decide whether it can decrypt in place. With the flag missing, it assumes the buffer is private and decrypts in place. The buffer is not private: it is backed by the page cache of a read-only file.

The exploit uses that write to overwrite the first 192 bytes of /usr/bin/su in the page cache with a stub that calls setresuid, setresgid, and execve /bin/sh. The on-disk binary is never touched. The kernel executes the corrupted copy, and the process comes back as root.

The second half: PHP2Shell

The other end of the chain is PHP2Shell, which we covered on October 22: two PHP bugs (CVE-2026-109618 and CVE-2026-109619), both CVSS 9.8, that let an unauthenticated attacker trigger remote code execution through memory corruption. PHP fixed both in the 8.5.12, 8.4.27, 8.3.36, and 8.2.35 releases on October 22.

Put together: an unauthenticated web RCE lands you in a PHP process, and fragnesia turns that into root. The whole chain is public, and CISA's KEV entry names it explicitly.

The part that breaks your detection

The operational detail that matters most is what the exploit leaves behind. The file on disk is clean. sha256sum /usr/bin/su matches the vendor hash. An integrity scanner that compares against the on-disk copy passes. The corruption lives in the page cache and persists until the page is evicted, which means a drop_caches or a reboot. A host can be fully rooted and still pass file integrity checks, and the only cleanup is to evict the page or restart.

The timeline sharpens it. The kernel patch landed in May (the NVD record was published 2026-05-23), but the KEV listing is only now. A host that patched its kernel in June and still runs PHP older than 8.5.12 is fully chainable today. Patching one side of the chain does not close it.

What to do

  • Debian kernels: bullseye 5.10.257-1, bookworm 6.1.174-1, trixie 6.12.90-1, unstable 7.0.9-1, per the Debian security tracker.
  • PHP: 8.5.12, 8.4.27, 8.3.36, or 8.2.35, per the php.net ChangeLog.
  • If you cannot patch immediately: rmmod esp4 esp6 rxrpc and block the modules via modprobe.d, the same mitigation as dirtyfrag. The tradeoff is that IPsec ESP traffic stops working, so weigh it against what actually uses ESP on the box.
  • CISA's ask: due date October 31 with forensic triage required. If you find evidence of exploitation, the catalog wants you to look, not just patch.

Sources

This article was drafted with AI/LLM assistance and reviewed by a human before publication. All factual claims were checked against the public sources cited above. The feature image was generated with AI. See How we use AI for the full workflow.

Topics:

Read more