Linux kernel flaw Fragnesia exploited: update, reboot

A Linux kernel flaw called Fragnesia (CVE-2026-46300) is now being used in real attacks, according to the US agency CISA, which added it to its exploited list on 28 October 2026. Anyone who can run code on a Linux machine, even with a normal account, may be able to take full control of it. Fixes have been out for months. Install the kernel update and restart.

What is Fragnesia?

Fragnesia is a bug in the part of the Linux kernel that handles one type of encrypted network traffic (IPsec). Red Hat lists it as a variant of the "Dirty Frag" flaws it reported in May 2026. Red Hat says a user with a local account could use these flaws to gain root, the highest level of access on the machine. Ubuntu rates it high priority and says it could also let an attacker break out of a container.

CISA also notes that attackers can combine it with other flaws to place hidden files on websites and run commands with full control. So it matters to any business that runs its own website on a Linux server.

Who is affected?

• Businesses with their own Linux server or VPS running Red Hat Enterprise Linux 8, 9 or 10, or Ubuntu 22.04, 24.04, 25.10 or 26.04. Other Linux systems may be affected too: check your vendor's security notice.
• Linux machines in the office that several people or apps log in to, such as a shared server or a test machine.
• Ubuntu 20.04 and older are not affected, according to Ubuntu.

Windows PCs and Macs are not affected.

What to do

1. Ask whoever manages your Linux server or VPS to install the latest kernel update from your Linux vendor today. Red Hat says fixes are out for all its affected products, and Ubuntu has fixed kernels for every affected release.
2. Restart the server after the update. A new kernel is only used after a reboot, so plan a short downtime, for example after office hours.
3. If you cannot update yet, ask your IT person to apply the temporary steps in the Red Hat or Ubuntu notice below. They can break VPN (IPsec) links or some container tools, so test first.
4. If your server hosts a website, check it for files you do not recognise and change the admin passwords if anything looks wrong.
5. If you are not sure who looks after your server, or you would like the updates handled for you, our website updates and care team can help, or ask us about managed business hosting so you do not have to patch a server yourself.

Source and credit

We are sharing this news from CISA, Red Hat and Ubuntu. This summary is written by Synctech in our own words.

• Known Exploited Vulnerabilities Catalog, entry CVE-2026-46300, CISA, 28 October 2026: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-46300
• RHSB-2026-003 Dirty Frag, Linux Kernel Networking Privilege Escalation, Red Hat, updated 3 July 2026: https://access.redhat.com/security/vulnerabilities/RHSB-2026-003
• CVE-2026-46300, Red Hat: https://access.redhat.com/security/cve/cve-2026-46300
• CVE-2026-46300, Ubuntu, updated 12 October 2026: https://ubuntu.com/security/CVE-2026-46300 Retrieved 29 October 2026. Linux, Red Hat and Ubuntu are trademarks of their owners. Synctech is not connected with them. This is general information, not legal, tax or financial advice. If anything here is wrong, email support@synctech.com.my and we will correct it.