PT-2026-40816 · Linux+4 · Linux Kernel+4
V4Bel
·
Published
2026-05-13
·
Updated
2026-06-29
·
CVE-2026-46300
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
Local privilege escalation is possible in the Linux kernel networking stack, specifically within the XFRM ESP-in-TCP receive path. The issue occurs when the kernel fails to correctly preserve the
SKBFL SHARED FRAG flag during the movement of paged fragments between socket buffers in functions such as skb try coalesce(), pskb copy fclone(), skb shift(), skb gro receive(), skb gro receive list(), tcp clone payload(), and skb segment().This failure creates a desynchronization between fragment metadata and page-cache-backed memory. Consequently, the
skb has shared frag() check returns false, allowing the ESP input process to perform in-place decryption directly over shared page-cache pages. An unprivileged local user can exploit this memory write primitive to corrupt read-only file cache entries, such as the /usr/bin/su binary or /etc/passwd, leading to the execution of a root shell.Recommendations
As a temporary mitigation, disable the
esp4, esp6, and rxrpc modules by running sudo modprobe -r esp4 esp6 rxrpc and blacklisting them.
Restrict unnecessary local shell access.
Harden containerized workloads.
Increase monitoring for abnormal privilege escalation activity.Exploit
Fix
DoS
LPE
RCE
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linuxmint
Linux Kernel
Red Os
Rocky Linux
Ubuntu