CVE-2026-46300: Linux Kernel Missing Initialization of a Variable Vulnerability

CISA's catalog entry says the Linux kernel flaw "could allow for unintended modification of page-cache-backed data"[2] because the shared-fragment marker is not kept when socket buffers are combined. According to CISA, this causes ESP input processing to decrypt shared fragments in place[2].Red Hat says the flaw, nicknamed "Fragnesia", lets a low-privileged local attacker write arbitrary bytes into the page cache of read-only files, including sensitive system files[3]. Red Hat adds that an attacker can exploit this to overwrite privileged binaries and gain root privileges.[3]Daily.dev reports that Israeli firm Dream claims attackers chained PHP2Shell with Fragnesia to root 25 servers, including a US government-affiliated environment, though it hasn't been independently verified.[4]SecurityOnline reports that federal agencies must fix the Linux kernel vulnerability by October 31[1]. The outlet notes that the kernel deadline gives agencies just three days, compared with two weeks for the ESX bug.[1]According to HOL Guard, the change happens in the page cache, not on disk, so a reboot or cache drop removes both the backdoor and the evidence.[5]SecurityOnline lists the bug as fixed in 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10 and 7.1[1]. Help Net Security reported in May that until patches are applied, admins should disable/denylist or unload the vulnerable modules (for both Fragnesia and DirtyFrag: esp4, esp6, rxrpc)[6].