Fragnesia: A Linux Kernel Out-of-Bounds Write That Hands Over Root

What happened

CVE-2026-46300, nicknamed Fragnesia, is an out-of-bounds write vulnerability in the Linux kernel. It allows an unprivileged local user to escalate to root by corrupting page-cache-backed data structures. It has been observed as the privilege-escalation half of multi-stage attacks — notably as the second stage after web RCE flaws such as PHP2Shell.

Why it matters

Most serious attacks on servers are not a single magic bug — they are chains. A remote flaw gets the attacker *onto* the box as a low-privileged user, and a local kernel bug gets them *root*. Fragnesia is a reliable "second stage" for exactly that reason, which is why it is showing up alongside internet-facing RCE exploits.

How an out-of-bounds write becomes root

An out-of-bounds write means the kernel writes data past the end of an allocated buffer. By carefully shaping memory beforehand (a technique called heap grooming), an attacker arranges for that overflow to overwrite something security-critical — for example, a structure that controls their own process's privileges. The result is that their ordinary user process suddenly has root authority.

How to defend

• Patch the kernel on all Linux hosts, prioritizing internet-facing servers and anything that also runs web code.


• Reduce local footholds: fewer ways for an attacker to get an initial unprivileged shell means fewer chances to use a local escalation bug.


• Enable kernel hardening features (for example, strict memory protections and exploit mitigations) where your distribution supports them.


• Use least privilege for web and application services so the first-stage account has as little as possible.

What it means for you

Fragnesia is a reminder that your patch strategy has to cover the whole stack, not just the app. A fully patched web application on an unpatched kernel is still one bug away from total compromise. For learners, chaining a remote bug to a local kernel bug is the single most important attack pattern to understand on Linux servers.