CVE-2026-46300

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A local privilege escalation issue exists in the Linux kernel networking stack, specifically within the XFRM ESP-in-TCP subsystem. The flaw originates in the skb try coalesce() function and the skb segment() function, where the kernel fails to correctly preserve the SKBFL SHARED FRAG flag when moving paged fragments between socket buffers or constructing GSO segments. This failure breaks the invariant relied upon by in-place writers; specifically, the esp input() function may incorrectly skip the skb cow data() check. Consequently, a low-privileged local attacker can perform unsafe in-place cryptographic processing (such as AES-GCM decryption) directly over page-cache-backed memory. This allows the attacker to write arbitrary bytes into the page cache of read-only files, such as /usr/bin/su or /etc/passwd, enabling the overwriting of privileged binaries to gain root privileges. This issue is a deterministic logic error and does not require a race condition.