Fragnesia is the nickname for CVE-2026-46300, a vulnerability in the Linux kernel. It is a local privilege escalation flaw in the kernel's XFRM ESP-in-TCP code, where a logic error lets an unprivileged local user write data into the page cache of files that are normally read-only. That can be turned into root access. It was publicly disclosed in May 2026 together with a proof-of-concept exploit, and it is rated high severity, with a CVSS score of 7.8.
The key detail is that Fragnesia is a local flaw. An attacker must already be able to run code on the machine before it helps them. That is why it matters alongside web vulnerabilities such as PHP2Shell: a remote code execution bug can give an attacker a foothold as the web server user, and a local privilege escalation flaw can then be used to try to move from that limited account to root. Reports describe the two being chained, but a Fragnesia-affected kernel does not by itself mean a remote attacker can reach it.
Whether a system is exposed depends on the kernel build, the distribution and its configuration. Distributions have published their own fixed kernel packages and, in some cases, interim mitigations, so a kernel version number should be checked against your vendor's advisory rather than against upstream version numbers alone. A public proof-of-concept shows the flaw can be triggered under the right conditions, not that a given server has been attacked.
Install the vendor-fixed kernel and reboot, or apply a live patch if your vendor provides one, and confirm the running kernel afterwards, since an installed update does not take effect until then. Where you cannot patch immediately, follow the vendor's documented mitigation and check what it disables before applying it. If a web-facing application was recently compromised, treat privilege escalation as a possibility during your investigation rather than assuming it did or did not happen.