Linux kernel page-cache write, actively exploited (CVE-2026-46300) [PoC]
CVE-2026-46300
CVE-2026-46300: Linux kernel skb coalescing drops the shared-frag marker, letting ESP decrypt in place over page cache (CVSS 7.8). Update your kernel now.
Actively exploited in the wild - CVE-2026-46300 is a high-severity local kernel vulnerability in Linux networking code (skb_try_coalesce and ESP input) that lets a local attacker corrupt read-only page-cache data and write to files they should not be able to modify. Distros have begun shipping fixes; update the kernel package immediately.
Overview
CVE-2026-46300 is a high-severity local kernel vulnerability in Linux networking code, tracked in CISA’s Known Exploited Vulnerabilities catalog, which confirms active exploitation in the wild. EPSS estimates a 10.2% probability of exploitation in the next 30 days.
The bug lives in skb_try_coalesce(), the routine that merges one network packet buffer into another during receive processing. When TCP receive coalescing moves paged fragments from one socket buffer to another, the code copies the fragment descriptors but drops the SKBFL_SHARED_FRAG marker. That marker tells later code paths that the data is externally owned or backed by the page cache, and therefore must never be written in place.
The impact
The missing marker breaks an invariant that in-place writers depend on. In particular, ESP (IPsec) input calls skb_has_shared_frag() to decide whether an uncloned nonlinear skb can skip skb_cow_data(). With the marker gone, ESP sees “no shared frags”, skips the copy, and decrypts in place directly over page-cache-backed pages. The result is memory corruption of file data the attacker does not own: a local user can modify read-only files and potentially escalate privileges. The CVSS score is 7.8, with a LOCAL attack vector, LOW complexity, LOW privileges required, and no user interaction.
Who is affected
Any Linux system running a kernel that includes the ESP input path (net/ipv4/esp4.c, net/ipv6/esp6.c) and the TCP receive coalescing path is potentially exposed, which in practice means most general-purpose distributions and container hosts. Systems that terminate IPsec tunnels are the most directly affected. Check whether your kernel version predates the upstream fix commit that propagates SKBFL_SHARED_FRAG from skb_try_coalesce().
Remediation and mitigation
- Update the kernel package to the version published by your distribution for CVE-2026-46300, then reboot, since a live kernel cannot be patched by a package update alone.
- If a distro does not yet ship a fix, apply live patching where your vendor offers it, or disable the affected ESP input path on hosts that do not need IPsec.
- Restrict local logon access to trusted users and reconsider untrusted multi-tenant workloads on hosts that terminate IPsec tunnels.
- Audit file integrity of read-only system paths for unexpected modifications, especially binaries and configuration under
/usrand/etc. - See the CISA KEV entry for this CVE for the current remediation due date.
What to watch for
CISA has added several Linux kernel memory-corruption bugs to its KEV catalog in recent months, including the local root bug in CVE-2026-31431, so kernel updates should now be treated as routine, high-priority patching rather than a monthly afterthought. The broader roundup of actively exploited kernel bugs is also covered in our weekly threat roundup.
Security insight
CVE-2026-46300 is a textbook invariant bug: a flag that stays correct in the path it was designed for, but silently drops out of a shared helper that other code trusts. The fact that TCP coalescing and IPsec decryption are miles apart in the codebase means no single reviewer would naturally catch the interaction. CISA KEV listing for a shallow-copy bug in a non-privileged path also suggests attackers are actively hunting for kernel bugs that need only local access, underscoring that local privilege escalation is a first-class threat, not a footnote.
Further Reading
Never miss a critical vulnerability
Get real-time security alerts delivered to your preferred platform.
Am I Affected by CVE-2026-46300?
Pick an ecosystem, paste your installed version, and we'll compare it against the fixed version published on OSV.dev. Browser-only — nothing is sent to a server.
Heuristic comparison only. Always cross-check against the vendor advisory before making patching decisions.
Metasploit Modules
Weaponized exploit code — authorized use only
The Metasploit Framework modules below are production-ready exploit code maintained by Rapid7. Unlike random GitHub PoCs, these are vetted by Metasploit maintainers and integrated into a point-and-click exploitation framework used by red teams worldwide. The presence of an MSF module means this CVE is trivially exploitable at scale — patch immediately.
Authorized use only. Run only against systems you own or have explicit written permission to test. Using exploit code against systems you do not own is illegal in most jurisdictions and violates Yazoul's terms of use.
| Module | Source |
|---|---|
exploit/linux/local/cve_2026_46300_fragnesia | View source |
1 Metasploit module indexed for this CVE. Source: rapid7/metasploit-framework.
Exploit-DB Entries
Curated public exploit code — authorized use only
The entries below are human-reviewed exploit code hosted on Exploit-DB by Offensive Security. Lower volume than random GitHub PoCs but higher signal: every entry is curated, many are tagged "verified" by the maintainers. Treat as production-ready exploit code.
Authorized use only. Run only against systems you own or have explicit written permission to test. Using exploit code against systems you do not own is illegal in most jurisdictions and violates Yazoul's terms of use.
| EDB-ID | Title | Status |
|---|---|---|
| EDB-52591 | Linux Kernel - Local Privilege Escalation | unverified |
1 Exploit-DB entry indexed for this CVE. Source: Exploit-DB.
Public PoC References
Unverified third-party code
These repositories are publicly listed on GitHub and have not been audited by Yazoul Security. They may contain malware, backdoors, destructive payloads, or operational security risks (telemetry, exfiltration). Treat them as hostile binaries. Inspect source before execution. Run only in isolated, disposable lab environments (offline VM, no credentials, no production data).
Authorized use only. This information is provided for defensive research, detection engineering, and patch validation. Using exploit code against systems you do not own or do not have explicit written permission to test is illegal in most jurisdictions and violates Yazoul's terms of use.
| Repository | Stars |
|---|---|
| 0xBlackash/CVE-2026-46300 CVE-2026-46300 | ★ 15 |
| MadExploits/CVE-2026-46300 CVE-2026-43284 - CVE-2026-43500 - CVE-2026-46300 Variant of dirtyfrag exploit | ★ 3 |
| HORKimhab/CVE-2026-46300 CVE-2026-46300 | ★ 2 |
| Sentebale/CVE-2026-46300 | ★ 1 |
| 1neptune/Fragnesia Add go CVE-2026-46300 (Fragnesia) local privilege escalation exploit | ★ 1 |
Showing 5 of 10 known references. Source: nomi-sec/PoC-in-GitHub.
Related Advisories
In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the Ethernet source address rewrite behind sk...
Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)...
An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This flaw can overwrite parts of the kernel state, potentially allowing a local user ...
In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE...
Other Linux Kernel Vulnerabilities
All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root....
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3...
In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE...
In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the Ethernet source address rewrite behind sk...