CVE-2026-46300

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw in the XFRM ESP-in-TCP subsystem of the Linux kernel allows a low-privileged local attacker to write arbitrary bytes into the page cache of read-only files, including sensitive system files. This occurs because the skb try coalesce() function fails to preserve the SKBFL SHARED FRAG marker when attaching paged fragments. Consequently, the ESP input process may incorrectly identify a shared fragment as non-shared via skb has shared frag(), skipping the necessary skb cow data() call and performing in-place decryption directly over page-cache backed fragments. This deterministic logic error can be exploited to overwrite privileged binaries and gain root privileges, potentially allowing for container escape. This issue emerged as a side effect of previous fixes related to the Dirty Frag family of vulnerabilities.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.