Fragnesia Linux Kernel Flaw: Is Your Server Affected?

Fragnesia is the name given to CVE-2026-46300, a flaw in the Linux kernel that lets someone who can already run code on a server make themselves the server's administrator (root). On 28 October 2026 the US cyber security agency CISA added it to its list of flaws being used in real attacks, and said it is being chained with the two PHP2Shell flaws to plant hidden scripts on web servers and run commands as root. Linux distributions have had fixed kernels for months, but a fixed kernel only protects a server once the server has been restarted onto it.

This article explains what Fragnesia is in plain terms, why it matters for websites even though it isn't a website flaw, which kernel versions fix it, and what to ask your host.

What Fragnesia Is, in Plain Terms

The kernel is the core of the Linux operating system that most web servers run on. Fragnesia is a bug in how the kernel handles a type of network traffic (ESP-in-TCP, used by some VPNs). A user with an ordinary, limited account on the server can use it to write into files they shouldn't be able to change, and from there become root.

On its own, that needs an attacker to have a foothold on the server already. Ubuntu rates it High priority, describing it as a "trivial local privilege escalation", with a CVSS score of 7.8. "Fragnesia" is the researchers' nickname, not a name used by the Linux kernel project.

Why a Kernel Flaw Matters for Your Website

Your website doesn't need to have a bug of its own for this to affect you. CISA's entry says Fragnesia can be chained with CVE-2026-109618 and CVE-2026-109619, the two PHP flaws known as PHP2Shell, to implant PHP web shells and run commands as root.

In practice that means one flaw gets an attacker onto the server through a website, and Fragnesia turns that into full control of the whole server. On shared hosting, that server can hold many other websites, email and databases as well as yours. Our PHP2Shell guide covers the first half of the chain.

Is Your Server Affected?

Any Linux server running a kernel without the fix is affected, whether it's a shared hosting server, a VPS or a dedicated server. Windows servers are not affected by this flaw.

If you're on shared hosting, the kernel belongs to your host, so there's nothing for you to update yourself. If you have your own VPS or server, updating the kernel and restarting it is your job, or your developer's.

Which Kernels Fix Fragnesia

Each Linux distribution ships its own fixed kernel. For Ubuntu, the most common choice for web servers, the Ubuntu security notice for CVE-2026-46300 lists these fixed versions:

Red Hat, Amazon Linux and other distributions have published their own fixes for this Linux kernel vulnerability. If your server runs something else, check that distribution's advisory for the same CVE number. On Ubuntu, a normal Ubuntu kernel update installs the fixed version.

How to Check Your Linux Kernel Version (Installed Is Not Running)

This is the part that catches servers out. Automatic updates will often install a new kernel, but the server keeps running the old one until it is restarted. A server can show every update installed and still be exposed. The command uname -r shows the kernel that is actually running; that is the version to compare with the table above.

Is Fragnesia Being Exploited?

Yes. CISA added CVE-2026-46300 to its Known Exploited Vulnerabilities catalogue on 28 October 2026, which it only does with evidence of real attacks, and gave US federal agencies until 31 October to fix it. Whether ransomware groups are using it is listed as unknown.

The fix has been available for months, so a server that is still exposed is one that hasn't been updated and restarted in months. That is worth asking about on its own.

What If the Server Can't Be Restarted Yet?

Ubuntu publishes a temporary mitigation for servers that can't be restarted straight away, the same procedure as for the earlier "Dirty Frag" flaw. It reduces the risk while a restart is arranged. It isn't the fix, and it's a job for whoever runs the server, not something to try on a live server without knowing what it does.

What to Ask Your Web Company or Host

If someone else looks after your hosting, these questions get to what matters:

• Which Linux kernel version is my server actually running right now, as shown by uname -r?

• Is that version fixed for CVE-2026-46300?

• When was the server last restarted onto a new kernel?

• Has the PHP version serving my site been updated for PHP2Shell?

A useful answer gives you a version number and a date. "We keep everything updated" isn't enough on its own, because the installed version and the running version can be different.

If Your Server Was Exposed: Check for Signs of a Hack

The attacks CISA describes leave files behind: PHP scripts that you didn't add, which let an attacker come back later. If your site's server was running an unfixed kernel and an unpatched PHP version in recent weeks, it's worth a check.

Our guide to signs your website has been hacked covers what to look for. If you find something you can't explain, our hacked website recovery service covers sites built on PHP, Node.js or JavaScript, including WordPress, and generally costs around £300 depending on whether usable backups are available. That service is for sites not on our platform.

Keeping Servers Patched Without Chasing It

Fragnesia had been fixed for months and was still being used in attacks in late October. The gap is rarely the fix itself; it's that someone has to install it and restart the server, and on many small business sites nobody is doing that.

On our platform, security patches and updates are handled as part of your plan, at the server level as well as the website. Every server we run was already on a fixed kernel when we checked on 10 November. Our sites are hosted in UK data centres on cloud infrastructure, every plan includes backups, and if a site on our platform is compromised, putting it right is included in the plan. Our managed websites page sets out what each plan covers.

Fragnesia FAQs

If you want hosting where server and website updates are handled for you, our managed websites plans set out what's included. Or get in touch to talk through your server and what needs to happen next.