CVE-2026-46300

What it actually does

CVE-2026-46300 is a Linux kernel memory-corruption flaw in the networking sk_buff coalescing path. When skb_try_coalesce() transfers paged fragments from one socket buffer to another, it can fail to preserve the SKBFL_SHARED_FRAG marker. Later ESP/IPsec input handling may incorrectly believe the buffer is safe for in-place modification and decrypt over externally owned or page-cache-backed fragments. This breaks kernel memory ownership assumptions and can lead to corruption of kernel-managed memory or file-backed page cache, with potential confidentiality, integrity, and availability impact, including privilege escalation or denial of service depending on kernel configuration and reachable code paths.

Why it matters to the business

Successful exploitation can allow a user or process with local access to destabilize Linux systems, corrupt data, or potentially gain elevated privileges. The risk is highest on multi-user Linux servers, container hosts, VPN/IPsec gateways, and systems where untrusted workloads can run. Although it is not marked as CISA KEV and is not reported as ransomware-used, the exploit maturity is listed as weaponized and threat actors Fragnesia and Fragnasia are associated with exploitation, so security teams should prioritize remediation over routine kernel patch cycles.

How an attack unfolds

An attacker first needs local execution capability, such as a low-privileged shell, compromised service account, malicious workload, or code execution inside a container. The attacker then triggers kernel networking behavior that causes TCP receive coalescing to move shared paged fragments into another sk_buff while losing the shared-fragment marker. If ESP/IPsec processing later handles that malformed buffer, the kernel may skip the copy-on-write path and decrypt data in place over fragments that should not be modified. A reliable exploit can use this broken memory ownership state to corrupt page-cache-backed data or kernel memory in a controlled way. Depending on hardening, kernel version, and system configuration, the outcome may be a kernel crash, data corruption, container escape, or local privilege escalation. Reported weaponization and named threat actor activity indicate defenders should assume public exploit techniques may exist or emerge quickly.

How to fix it

Apply the vendor kernel update that includes the fix to preserve SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged fragments. No exact fixed package versions were provided, so use the latest supported kernel from the Linux distribution or kernel vendor and confirm the advisory explicitly references this fix or the affected networking/skbuff change. Reboot into the patched kernel or confirm an approved live patch is active. As interim mitigation, reduce opportunities for local exploitation by limiting shell access, restricting untrusted workloads, disabling unnecessary unprivileged user namespaces where operationally feasible, enforcing container isolation controls, and limiting IPsec/ESP exposure or usage on systems that do not require it. Treat internet-facing VPN/IPsec infrastructure and shared container platforms as priority assets.

How to confirm the fix worked

Confirm the active runtime kernel, not only the installed package, has been updated. Validate with uname -a, distribution package tools, vendor advisory metadata, and live-patching status where applicable. Review the patched kernel source or vendor changelog for the skbuff fix that propagates SKBFL_SHARED_FRAG in skb_try_coalesce(). After patching, reboot if required and verify the system is no longer running the vulnerable kernel build. For high-assurance environments, run any vendor-provided regression tests for networking, TCP receive coalescing, ESP/IPsec, and xfrm paths in a non-production environment. Also verify that container hosts and golden images have been rebuilt so new workloads do not continue booting vulnerable kernels.

Typical attack path

1. Obtain local code execution on a Linux system as an unprivileged user, service account, or workload.
2. Identify that the running kernel lacks the sk_buff shared-fragment marker fix.
3. Prepare traffic or local socket activity that causes skb_try_coalesce() to transfer paged fragments between socket buffers.
4. Drive the affected path so SKBFL_SHARED_FRAG is lost after coalescing.
5. Trigger ESP/IPsec input handling against the affected buffer so the kernel incorrectly skips skb_cow_data().
6. Cause in-place writes over externally owned or page-cache-backed fragments.
7. Use the resulting memory or page-cache corruption to crash the host, corrupt data, or attempt privilege escalation.

How to detect it

Exploitation may leave little application-layer evidence because the vulnerable behavior occurs inside the kernel networking stack. Review kernel logs from journalctl -k, dmesg, /var/log/kern.log, /var/log/messages, and crash dump infrastructure for oopses, panics, BUG/WARNING traces, general protection faults, page faults, or memory corruption messages involving skbuff, skb_try_coalesce, skb_cow_data, skb_has_shared_frag, ESP, IPsec, or xfrm. Check auditd, EDR, and shell history for low-privileged users compiling or executing unusual local binaries, especially from /tmp, /var/tmp, /dev/shm, container writable layers, or ephemeral build directories. On VPN/IPsec systems, review xfrm/IPsec daemon logs and network telemetry for abnormal ESP traffic patterns preceding kernel instability. Investigate unexplained file corruption, checksum changes, or integrity-monitoring alerts that coincide with local suspicious process execution or ESP/IPsec traffic. Because Fragnesia and Fragnasia are reported threat actors, correlate any actor-specific infrastructure, malware, or tradecraft from threat intelligence feeds with local privilege-escalation attempts on Linux hosts.

• skb_try_coalesce
• skb_cow_data
• skb_has_shared_frag
• SKBFL_SHARED_FRAG
• xfrm
• ESP
• IPsec
• kernel BUG
• kernel panic
• general protection fault
• BUG: unable to handle page fault
• Oops:
• /var/log/kern.log
• /var/log/messages
• /var/crash
• /tmp/
• /var/tmp/
• /dev/shm/

What your security team should do

• Prioritize patching Linux systems that allow local users, run containers, host untrusted workloads, or provide VPN/IPsec/ESP services.
• Inventory running kernel versions across servers, container hosts, appliances, and cloud images; do not rely only on package inventory because stale kernels may remain active until reboot.
• Search endpoint and kernel logs for crashes, oopses, panics, xfrm/ESP anomalies, and unexplained file or page-cache corruption since the vulnerability was published.
• Hunt for suspicious local exploit staging by low-privileged users, including unusual compiled binaries, temporary executables, and processes interacting heavily with sockets, network namespaces, or IPsec tooling.
• Increase monitoring on systems exposed to shared workloads because a local privilege-escalation path can turn a low-impact foothold into full host compromise.
• If immediate patching is not possible, restrict interactive access, reduce untrusted local code execution, harden containers, and disable unnecessary ESP/IPsec functionality until remediation is complete.
• Track threat reporting for Fragnesia and Fragnasia activity and update detection content as actor-specific tooling, filenames, hashes, or command patterns become available.