Linux Kernel XFRM ESP-in-TCP Subsystem Fragnesia write-what-where condition

Summaryinfo

A vulnerability described as critical has been identified in Linux Kernel. Affected is an unknown function of the component XFRM ESP-in-TCP Subsystem. Executing a manipulation can lead to write-what-where condition. This vulnerability is tracked as CVE-2026-46300. The attack is restricted to local execution. Moreover, an exploit is present.

Detailsinfo

A vulnerability has been found in Linux Kernel (unknown version) and classified as critical. This vulnerability affects an unknown code block of the component XFRM ESP-in-TCP Subsystem. The manipulation with an unknown input leads to a write-what-where condition vulnerability. The CWE definition for the vulnerability is CWE-123. Any condition where the attacker has the ability to write an arbitrary value to an arbitrary location, often as the result of a buffer overflow. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.

The advisory is available at bugzilla.redhat.com. This vulnerability was named CVE-2026-46300. The exploitation appears to be easy. Local access is required to approach this attack. Technical details are unknown but a public exploit is available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 06/30/2026).

A public exploit has been developed in ANSI C. It is possible to download the exploit at github.com. It is declared as proof-of-concept. The vulnerability scanner Nessus provides a plugin with the ID 314601 (Fedora 42 : kernel (2026-ec1c523fdb)), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Exploit-DB (52591), Tenable (314601), EUVD (EUVD-2026-31535) and CERT Bund (WID-SEC-2026-1530). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Affected

• Google Container-Optimized OS
• Amazon Linux 2
• Red Hat Enterprise Linux
• Fedora Linux
• Ubuntu Linux
• SUSE Linux
• SUSE openSUSE
• Open Source Linux Kernel
• Nutanix Files
• RESF Rocky Linux
• Debian Linux
• Oracle Linux
• Nutanix Kubernetes Engine
• Red Hat OpenShift
• IBM QRadar SIEM

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion