CISA links a Linux kernel ESP fragmentation flaw to the PHP2Shell chain for root access

October 28, 2026. CISA adds CVE-2026-46300 to its Known Exploited Vulnerabilities (KEV) catalog, with a remediation deadline set for October 31, 2026 — three days away. October 28, 2026. The entry states the flaw “can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.” October 21, 2026. Those two flaws, bundled under the name PHP2Shell, had already forced an emergency PHP patch. What matters: an initialization bug in the kernel’s ESP-in-TCP path — long filed under local privilege escalation — is now the escalation stage of a complete web attack chain.

An uninitialized variable inside IPsec

CVE-2026-46300 is classified CWE-456, “missing initialization of a variable.” The defect lives in the kernel’s XFRM subsystem, the layer that implements IPsec transformations — specifically in the handling of ESP packets encapsulated inside TCP, the ESP-in-TCP mode used to traverse NAT boxes that block UDP.

CISA’s description is technical but precise. During socket buffer coalescing, the kernel fails to preserve the shared-fragment marker. As a result, ESP input processing decrypts shared fragments in place, enabling unintended modification of page-cache-backed data. In plain terms, an attacker can corrupt the memory that backs files — the same mechanism behind Dirty Pipe, the 2022 flaw that wrote to read-only files.

The KEV entry references eight fix commits across the kernel’s stable branches, which signals a bug present in several kernel generations and fixed independently on each. The nature of the defect — corrupted page-cache state — is what makes the PHP2Shell chain credible.

The chain: from a compromised PHP site to root

What changed on October 28 is not the flaw itself but its official exploited status and the explicit link to PHP2Shell. Until now, CVE-2026-46300 was documented as a local privilege escalation: you already needed a foothold on the machine to use it. CISA’s note reframes it by tying the flaw to the two remote code execution bugs in PHP.

The chain reads cleanly. An attacker exploits CVE-2026-109618 or CVE-2026-109619 to get code execution on an unpatched PHP web server — the unauthenticated entry point, demonstrated against Apache mod_php. They drop a webshell running as the PHP process, typically a service account. Then they abuse CVE-2026-46300 to turn that limited account into root. The webshell stops being a persistence mechanism and becomes the foothold for full machine compromise.

It is a familiar pattern, but official recognition changes the priority. Teams that patched PHP on October 21 yet deferred the kernel update believe they closed the door — they actually left the ladder in place.

Dirty Frag: a family of fragmentation flaws

CVE-2026-46300 is not isolated. It belongs to the Dirty Frag family, documented in Red Hat’s bulletin RHSB-2026-003, which groups several fragmentation flaws in the kernel’s network subsystem: CVE-2026-43284 in the ESP path and CVE-2026-46300 in the ESP-in-TCP variant, nicknamed Fragnesia.

Researcher Hyunwoo Kim (aka @v4bel) published a reference repository on GitHub, V4bel/dirtyfrag, describing the vulnerability class and its kinship with Dirty Pipe and Copy Fail: in every case, page-cache manipulation lets an attacker write where the kernel should not. The public Dirty Frag proof of concept chains CVE-2026-43284 and CVE-2026-43500 (in the RxRPC subsystem) to reach root on major Linux distributions.

This blog’s earlier piece on the IPv6 fragmentation flaw already noted in September that three fragmentation flaws in one quarter marked a kernel region that had become a hunting ground. The KEV entry confirms the hunt has moved from research to exploitation.

Three days, and mandatory forensic triage

The October 31 deadline is unusually tight: the KEV catalog normally grants longer windows aligned with BOD 22-01. Here CISA flags the flaw “Forensic triage required” under BOD 26-04, which mandates forensic analysis ahead of patching when exploitation is suspected. In other words, patching is not enough — you must first determine whether the machine was already compromised.

The affected surface is broad. The flaw lives in the Linux kernel, so everything that embeds it is in scope: servers, containers, appliances, virtualization hosts. Docker does not save you — containers share the host kernel. The question is not “am I affected?” but “which kernel version is running, and is it patched?”

uname -r
# Check the version, then apply your distribution’s updates:
sudo apt update && sudo apt upgrade   # Debian / Ubuntu
sudo dnf upgrade                      # Fedora / RHEL

CISA’s guidance fits in one sentence: apply the kernel fixes and, for exposed services, preserve logs before rebooting — forensic analysis requires intact evidence.

Verdict

If you run public PHP without the October 21 fixes, treat this bulletin as a level-one emergency: you carry both the entry point and the escalation stage, and CISA explicitly describes the full chain to root. If you patched PHP but not the kernel, schedule the kernel update before October 31 and accept the reboot — a patched kernel that is not loaded protects nothing. And if you host PHP on a shared or multi-tenant machine, demand proof that the host kernel is patched, not just yours: the flaw operates below containers and virtual machines. The lesson is less technical than strategic — a local flaw only stays local until a remote flaw hands it a foothold.

References

• CISA — Known Exploited Vulnerabilities Catalog, CVE-2026-46300 entry (October 28, 2026)
• CISA — BOD 26-04: Prioritizing Security Updates Based on Risk
• GitHub — V4bel/dirtyfrag: description of the Dirty Frag vulnerability class
• Red Hat — RHSB-2026-003 “Dirty Frag”
• Linuxfabrik — Kernel Vulnerability “Dirty Frag” (CVE-2026-43284)
• Tenable — Dirty Frag (CVE-2026-43284, CVE-2026-43500): FAQ
• ETTAYEB — PHP2Shell: two critical RCEs hit PHP since version 5.4
• ETTAYEB — An IPv6 fragmentation miscalculation in the Linux kernel enables container escape