CVE-2026-46300

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A local privilege escalation issue exists in the Linux kernel networking stack, specifically within the XFRM ESP-in-TCP subsystem. The flaw originates in the skb try coalesce() function, where the kernel fails to preserve the SKBFL SHARED FRAG flag when moving paged fragments between socket buffers. This failure breaks the invariant relied upon by in-place writers; specifically, the ESP input process checks skb has shared frag() to determine if it can skip skb cow data(). If the flag is lost during TCP receive coalescing, the system may perform AES-GCM decryption in-place over page-cache-backed fragments.

A low-privileged local attacker can exploit this to write arbitrary bytes into the page cache of read-only files, such as /usr/bin/su or /etc/passwd. By overwriting privileged binaries or sensitive system files, the attacker can gain root privileges. This is a deterministic logic error that does not require a race condition.