hypeorhack
← back

CVE-2026-46300

HIGH · 7.8 KEV EPSS 16.1%
hype LIKELY HACK · 78 hack

Public PoC, distro advisories, defender triage active; KEV-listing pending metadata.

What: Linux kernel privilege escalation in XFRM ESP-in-TCP subsystem (CVE-2026-46300, "Fragnesia") allowing unprivileged attackers to gain root via AES-GCM keystream manipulation.

Why it matters: Multiple major Linux distros have issued advisories; public PoC exists; described as third LPE in ~2 weeks. High-confidence technical signal: arbitrary byte writes into page cache of privileged binaries (e.g., /usr/bin/su). Defenders are actively recommending module blacklisting as immediate mitigation.

Where it's seen: Security media (HackersNews, Borncity), DFIR/defender accounts triaging, distro advisory circulation. Posts cite concrete attack surface (XFRM, IPsec) and exploitation mechanics.

RISK: CRITICAL — Unauthenticated local root escalation with public PoC; distro patches confirmed.

Generated by claude-haiku-4-5 from public posts and authoritative metadata. AI can make mistakes — verify against vendor advisories before acting. 5/14/2026, 2:34:36 PM

Description

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.

CVSS 3.1 breakdown

Exploitability 1.8 · Impact 5.9
vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Affected versions

  • linux/linux_kernel
    • 3.9 – 5.10.257
    • 5.11 – < 5.15.208
    • 5.16 – < 6.1.174
    • 6.2 – < 6.6.141
    • 6.7 – < 6.12.91
    • 6.13 – < 6.18.33
    • 6.19 – < 7.0.10
    • 7.1

Weaknesses

Vendors

  • linux

Products

  • linux_kernel

References

Other · 42