Fragnesia (CVE-2026-46300)

Fragnesia is the third high-severity Linux kernel privilege-escalation bug published in the past month, after Dirty Frag and Copy Fail. It targets the XFRM (transformation framework) subsystem, the kernel component normally used by IPsec VPNs, and exploits a logic bug to write arbitrary bytes into the kernel page cache of read-only files. The published proof of concept corrupts the page cache of /usr/bin/su and immediately yields a root shell.

In the words of the disclosing researcher, William Bowling: "Fragnesia is a member of the Dirty Frag vulnerability class. This is a separate bug in the ESP/XFRM from dirtyfrag which has received its own patch. However, it is in the same surface and the mitigation is the same as for dirtyfrag."

The CVE is rated 7.8/10 (High) and affects current Linux kernels until patched. Critically, exploitation requires local access, an attacker must already have shell-level access on the server. They cannot trigger Fragnesia remotely without first establishing that foothold.

Magento 2 is one of the most actively attacked ecommerce platforms in the world. Successful attacks typically follow a chain: an attacker exploits a vulnerable Magento extension or a known Magento core CVE; they obtain a webshell running as the web server user (usually www-data or nginx); they use the webshell to install backdoors, dump customer records, or exfiltrate payment card details.

For most of that chain, the attacker is constrained by the web server user's permissions. They cannot read system credential files. They cannot modify cron entries. They cannot install root-level malware that survives a reboot. They cannot easily move laterally to other databases or services on the same machine.

Fragnesia removes that ceiling. A successful Magento webshell combined with Fragnesia gives an attacker full root on the server. From root, they can:

• →Read every customer record, order, and stored payment token
• →Modify Magento source files to inject Magecart-style card skimmers into checkout
• →Install persistent rootkits that survive reboots and standard malware scans
• →On shared or multi-tenant hosting, compromise other customers on the same physical hardware
• →Disable security monitoring and tamper with audit logs to hide their tracks

This is why local-only privilege-escalation bugs are more dangerous to ecommerce than they first appear. The "local" qualifier doesn't mean "low impact": it means "the second step of a two-step attack." Magento provides the first step frequently enough that any unpatched local-escalation CVE is a real, present threat to live stores.

SSH into your server and run:

uname -r

Compare the kernel version against your distribution's security advisory for CVE-2026-46300:

• Ubuntu: check Ubuntu Security Notices (USN) for CVE-2026-46300
• Debian: check the Debian Security Tracker entry for CVE-2026-46300
• RHEL / AlmaLinux / Rocky: check the Red Hat CVE database for CVE-2026-46300
• Amazon Linux: check the Amazon Linux Security Center

If your kernel is older than the fixed version listed by your distribution, you are vulnerable. The fix is to update via your package manager (apt, yum, dnf) and reboot the server.

EveryHost servers receive kernel patches as part of standard managed Magento 2 hosting. As of publication, our security team is reviewing the upstream Fragnesia patch and rolling it out across the Magento hosting fleet in phases over the next 24–72 hours, prioritising servers running externally-exposed Magento admin panels.

We are not claiming our Sentinel WAF blocks Fragnesia. It doesn't. Fragnesia is a kernel-level bug, not a web-layer one, and no WAF can mitigate it. What Sentinel WAF does is block the upstream half of the attack chain: the Magento exploits, webshell uploads, and brute-force attacks against admin endpoints that an attacker would need to establish the local foothold before Fragnesia becomes reachable.

Defence in depth means: when the kernel has an unpatched local-escalation bug, and there will always be one somewhere; Dirty Frag, Copy Fail and Fragnesia are three in two months, the layers above the kernel buy you time. EveryHost runs a stack designed to keep attackers out of the web layer in the first place, so that kernel-level bugs are much harder to chain into a real compromise.

Most UK Magento hosting is shared infrastructure of one kind or another: shared CPU on a VPS, shared filesystem on cPanel hosting, shared kernel on a container platform. A Fragnesia-style local-escalation bug on shared infrastructure is devastating because one tenant's foothold can yield kernel-level access that affects every other tenant on the same physical node. Your store can be compromised through someone else's vulnerability, on a server you don't even share a customer base with.

EveryHost runs single-tenant dedicated NVMe servers for Magento hosting. Your server runs your kernel, used by no one else. A Fragnesia-class bug on EveryHost still requires patching, we patch, but the blast radius of any kernel-level event is bounded to one customer's data, one customer's store, one customer's reboot window. Not a shared cluster.

That isn't an argument for relaxing security. It's an argument for why the architecture choices your hosting provider made, three years before this CVE was disclosed, determine your exposure when the next kernel bug is published.