Skip to main content

Linux Kernel CVE-2026-46300

| EUVDEUVD-2026-31535 HIGH
Write-what-where Condition (CWE-123)
2026-05-13 secalert@redhat.com GHSA-47jg-vqrv-5f8v
Privilege Escalation Linux
7.8
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain local user account
  2. Delivery
    Trigger XFRM ESP-in-TCP flaw
  3. Exploit
    Write arbitrary bytes to kernel page cache
  4. Execution
    Overwrite kernel memory structures
  5. Persist
    Escalate to root privileges
  6. Impact
    Execute arbitrary code as root

Vulnerability Assessment

Weakness
CWE
CWE-123
Exploitation Conditions

Attacker must have authenticated local user access to the target Linux system-remote exploitation is not possible (CVSS AV:L). The vulnerable XFRM ESP-in-TCP subsystem code must be compiled into the kernel and the relevant kernel module must be loaded, which requires either IPsec ESP-in-TCP configuration to be active or the module to be manually loaded. Many default Linux installations may not enable ESP-in-TCP functionality, limiting exposure to systems explicitly configured for IPsec VPN NAT traversal or environments where administrators have loaded networking protocol modules. No elevated privileges beyond basic user-level access (PR:L) are required for initial exploitation, and no user interaction (UI:N) is needed. The low attack complexity (AC:L) indicates no race conditions or hard-to-meet timing requirements. Systems without local user accounts (single-user systems, appliances with no shell access) and systems where ESP-in-TCP kernel module is not loaded are not exploitable despite running vulnerable kernel versions.
Impact

Real-world risk is moderate-high for multi-user Linux systems but constrained by local access requirements. CVSS 7.8 accurately reflects the severe post-exploitation impact (complete system compromise) while accounting for the local attack vector limitation (AV:L). The low attack complexity (AC:L) and low privileges required (PR:L) indicate any authenticated local user can exploit this without specialized access or race conditions. Absence from CISA KEV and no identified public POC suggest exploitation has not occurred in the wild or remains limited to controlled research environments. The XFRM ESP-in-TCP subsystem is a specialized networking feature not universally enabled-many default Linux installations may not compile this module or have IPsec/ESP-in-TCP configured, significantly reducing the attack surface. However, systems using IPsec VPNs with NAT traversal (common in enterprise environments) likely have this code path active. Priority should be HIGH for cloud hosting providers, container platforms, and shared hosting environments where untrusted local users exist, but MEDIUM for single-user workstations or systems without ESP-in-TCP functionality enabled. The named vulnerability 'Fragnesia' suggests active security research which may accelerate public exploit development.
Exploit ScenarioDerived

An attacker with a low-privilege local user account on a Linux server running vulnerable kernel with ESP-in-TCP enabled gains initial access through compromised credentials or a web application vulnerability. The attacker exploits the XFRM subsystem flaw to perform arbitrary byte writes into the kernel page cache targeting read-only system files. By carefully crafting these writes, the attacker overwrites kernel data structures (such as credential structures or function pointers) cached in memory, escalating privileges to root. With root access, the attacker installs persistent backdoors, exfiltrates sensitive data, or pivots to other systems. No public proof-of-concept code has been identified, but the vulnerability's naming ('Fragnesia') and technical specificity suggest exploit code may exist in research contexts.
Act Now Prioritize within 24-48h. Why: In CISA KEV with patch available.
Exploited in the wild (CISA KEV) Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 14, 2026

Local privilege escalation in Linux kernel XFRM ESP-in-TCP subsystem (Fragnesia vulnerability) allows authenticated local attackers to overwrite kernel memory structures by exploiting arbitrary byte writes into the kernel page cache of read-only files. CVSS score of 7.8 reflects high impact across confidentiality, integrity, and availability. Low attack complexity (AC:L) and no user interaction requirement (UI:N) make this exploitable by any local user with basic privileges. No confirmed active exploitation (not in CISA KEV) or public proof-of-concept identified at time of analysis, but the specific vulnerability name 'Fragnesia' suggests coordinated disclosure with security research community.

RemediationAI

Apply vendor-released kernel security updates as soon as available from your Linux distribution maintainer. Red Hat, Ubuntu, Debian, SUSE, and other major distributions will publish kernel patches addressing CVE-2026-46300 through their standard security update channels. No specific patched kernel version has been confirmed in available data-monitor your distribution's security mailing lists and repositories. For Red Hat-based systems, check for updates via 'yum update kernel' or 'dnf update kernel' and subscribe to Red Hat Security Advisories. For Debian/Ubuntu systems, monitor USN announcements and apply updates with 'apt update && apt upgrade'. Reboot systems after kernel updates to load the patched version. As a temporary workaround until patches are deployed, disable or unload the ESP-in-TCP kernel module if your environment does not require IPsec NAT traversal functionality-this eliminates the vulnerable code path but breaks ESP-in-TCP VPN connectivity. Use 'modprobe -r xfrm_espintcp' to unload (note: module name may vary by kernel version). For containerized environments, update the host kernel rather than container images, as this is a kernel-level vulnerability. Restricting local user access reduces exposure but does not eliminate risk from compromised user accounts.

Affected VersionsENISA

Linux cef401de7be8c4e155c6746bfccf721a4fa5fab9 <2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c
Linux cef401de7be8c4e155c6746bfccf721a4fa5fab9 <f84eca5817390257cef78013d0112481c503b4a3
Linux patch: 7.1-rc5
Linux cef401de7be8c4e155c6746bfccf721a4fa5fab9 <9bc9d6d6967a2239aa57af2aa53554eddd640d20
Linux patch: 6.18.33
Linux cef401de7be8c4e155c6746bfccf721a4fa5fab9 <760e1addc27ba1a7beb4a0a7e8b3e9ec49e7a34e
Linux cef401de7be8c4e155c6746bfccf721a4fa5fab9 <78bf6b6bb19541d19fbda6242e7cfe2c682763c0
Linux cef401de7be8c4e155c6746bfccf721a4fa5fab9 <fc6eb39c55e97df2f94ad974b8a5bbcd019da2c8
Linux patch: 0
Linux cef401de7be8c4e155c6746bfccf721a4fa5fab9 <12401fcfb01f53ccc63ab0a3246570fe8f3105ee
Linux patch: 6.1.174
Linux cef401de7be8c4e155c6746bfccf721a4fa5fab9 <989214c66884d70716d83dc1d0bf5e16287bf349
Linux cef401de7be8c4e155c6746bfccf721a4fa5fab9 <9d3e5fd19fe1063bf607219e8562fbd567b8e8d5
Linux cef401de7be8c4e155c6746bfccf721a4fa5fab9 <3884358a9286b17f389a72b1426fc4547c23c111
Linux patch: 7.0.10
Linux 3.9
Linux cef401de7be8c4e155c6746bfccf721a4fa5fab9 <fbeab9555564a1b98e8582cd106dfe46c4606991
Linux cef401de7be8c4e155c6746bfccf721a4fa5fab9 <ff375cc75f9167168db38e0464a482d5fbc8d81d
Linux patch: 5.15.208
Linux patch: 6.12.91
Linux cef401de7be8c4e155c6746bfccf721a4fa5fab9 <179f1852bdedc300e373e807cc102cd81feff196
Linux patch: 6.6.141
Linux patch: 5.10.257
Linux cef401de7be8c4e155c6746bfccf721a4fa5fab9 <3bd9e113d50034db99d7ef69fd8e5242d15e414a
Linux cef401de7be8c4e155c6746bfccf721a4fa5fab9 <3599e6b3cc1ada96883d496a50a210d3afbb6987

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The Linux kernel XFRM (transform) framework handles IPsec transformations including ESP (Encapsulated Security Payload) protocol operations. The ESP-in-TCP encapsulation feature allows ESP packets to traverse NAT devices by wrapping them in TCP segments. CWE-123 (Write-what-where Condition) indicates the vulnerability allows an attacker to control both the memory address (where) and the data (what) being written. The flaw enables manipulation of the kernel page cache-a memory management component that caches file contents-specifically targeting read-only files which should be immutable. By achieving arbitrary writes into this cache, an attacker can modify kernel data structures that rely on cached file content integrity, leading to privilege escalation when these corrupted structures are subsequently used by the kernel. This represents a fundamental breakdown in memory protection boundaries between user space and kernel space within the XFRM subsystem's handling of encapsulated traffic.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SUSE 8.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Red Hat HIGH

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Added to CISA KEV
Oct 28, 2026 - 20:04 CISA
CVE Published
May 13, 2026 - 12:00 nvd
HIGH 7.8

DescriptionNVD

A flaw was found in the Linux kernel's XFRM ESP-in-TCP subsystem. This vulnerability, known as Fragnesia, allows a local attacker to achieve arbitrary byte writes into the kernel page cache of read-only files, enabling local privilege escalation through kernel structure overwriting.

Articles & Coverage 4

POC CVE-2026-46300 (Fragnesia): Linux Kernel skb_try_coalesce() Flaw Enables Local Root via Page-Cache Corruption May 16, 2026 medium.com CVE-2026-46300 Fragnesia: Linux Kernel Privilege Escalation to Root May 14, 2026 bleepingcomputer.com CVE-2026-46300 Fragnesia: Linux Kernel Privilege Escalation to Root May 14, 2026 vuln.today Fragnesia (CVE-2026-46300): Linux Kernel LPE via XFRM ESP-in-TCP May 13, 2026

Executive ViewAI

Why It Matters

CVE-2026-46300 is a local privilege escalation vulnerability in the Linux kernel XFRM ESP-in-TCP subsystem that allows authenticated local users to overwrite kernel memory and potentially gain system-level control. Any organization running affected Linux systems faces risk of insider threats or compromised user accounts being leveraged to compromise kernel integrity and sensitive data. This requires immediate inventory and mitigation planning as no vendor patch is currently available.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict local user account creation and privilege levels via PAM and SELinux mandatory access controls; (2) Disable XFRM subsystem via kernel module blacklist (modprobe -r xfrm_algo) if operationally permitted; (3) Monitor /proc/meminfo and kernel logs for memory manipulation anomalies; (4) Deploy kernel live-patching infrastructure to enable rapid updates when patches become available; (5) Isolate high-risk systems to air-gapped networks where feasible.

Threat Intelligence Overview

Threat Score
6.6/10
Composite threat intelligence
EPSS Score
0.0%
Top 85% exploitable
Threat Intel
3
1 sources
Exploit
POC
Public exploit code exists
Data Quality
11 sources
Confidence: High
EUVD NVD CVE.org CISA KEV EPSS CISA NEWS MSRC POC (1) Vendor Exploit-DB GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV Yes
Public POC Yes
EPSS 0.0%
Patch available Yes
Active threat Yes
Deciding rule
In CISA KEV with patch available
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Out-of-Cycle
Exploitation· derived
Active
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

134
Low Medium High Critical
KEV: +50
EPSS: 0
CVSS: +39
PoC: +20
Weaponized: +15
Threat intel: +10
Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.

Same weakness CWE-123 – Write-what-where Condition

View all
CVE-2024-42479 CRITICAL POC
10.0
CVE-2015-8271 CRITICAL POC
9.8
CVE-2022-38143 CRITICAL POC
9.8
CVE-2026-94142 HIGH POC
8.5
CVE-2022-35408 HIGH POC
8.2
CVE-2022-40262 HIGH POC
8.2
CVE-2024-2607 HIGH POC
8.1
CVE-2018-3971 HIGH POC
7.8

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
Container suse/sle-micro-rancher/5.3:latest Container suse/sle-micro-rancher/5.4:5.4.4.5.109 Image SLES15-SP4-BYOS Image SLES15-SP4-BYOS-Azure Image SLES15-SP4-BYOS-EC2 Image SLES15-SP4-BYOS-GCE Image SLES15-SP4-CHOST-BYOS Image SLES15-SP4-CHOST-BYOS-Aliyun Image SLES15-SP4-CHOST-BYOS-Azure Image SLES15-SP4-CHOST-BYOS-EC2 Image SLES15-SP4-CHOST-BYOS-GCE Image SLES15-SP4-CHOST-BYOS-SAP-CCloud Image SLES15-SP4-HPC-BYOS Image SLES15-SP4-HPC-BYOS-Azure Image SLES15-SP4-HPC-BYOS-EC2 Image SLES15-SP4-HPC-BYOS-GCE Image SLES15-SP4-HPC-EC2 Image SLES15-SP4-HPC-GCE Image SLES15-SP4-Hardened-BYOS Image SLES15-SP4-Hardened-BYOS-Azure Image SLES15-SP4-Hardened-BYOS-EC2 Image SLES15-SP4-Hardened-BYOS-GCE Image SLES15-SP4-SAP Image SLES15-SP4-SAP-Azure Image SLES15-SP4-SAP-EC2 Image SLES15-SP4-SAP-GCE Image SLES15-SP4-SAPCAL Image SLES15-SP4-SAPCAL-Azure Image SLES15-SP4-SAPCAL-EC2 Image SLES15-SP4-SAPCAL-GCE Affected
Container suse/sle-micro/base-5.5:2.0.4-5.8.274 Image SLES15-SP5-BYOS-Azure Image SLES15-SP5-BYOS-EC2 Image SLES15-SP5-BYOS-GCE Image SLES15-SP5-CHOST-BYOS-Aliyun Image SLES15-SP5-CHOST-BYOS-Azure Image SLES15-SP5-CHOST-BYOS-EC2 Image SLES15-SP5-CHOST-BYOS-GCE Image SLES15-SP5-CHOST-BYOS-GDC Image SLES15-SP5-CHOST-BYOS-SAP-CCloud Image SLES15-SP5-EC2 Image SLES15-SP5-GCE Image SLES15-SP5-HPC-BYOS-Azure Image SLES15-SP5-HPC-BYOS-EC2 Image SLES15-SP5-HPC-BYOS-GCE Image SLES15-SP5-Hardened-BYOS-Azure Image SLES15-SP5-Hardened-BYOS-EC2 Image SLES15-SP5-Hardened-BYOS-GCE Image SLES15-SP5-SAPCAL-Azure Image SLES15-SP5-SAPCAL-EC2 Image SLES15-SP5-SAPCAL-GCE Affected
Container suse/sle-micro/kvm-5.5:2.0.4-3.5.529 Affected
Container suse/sle-micro/rt-5.5:2.0.4-4.5.586 Affected
Image SLES12-SP5-Azure-BYOS Image SLES12-SP5-Azure-HPC-BYOS Image SLES12-SP5-EC2-BYOS Image SLES12-SP5-EC2-ECS-On-Demand Image SLES12-SP5-EC2-On-Demand Image SLES12-SP5-GCE-BYOS Image SLES12-SP5-GCE-On-Demand Affected

Threat IntelligenceMISP

CISA Advisories
ICSA-26-174-06 ICSA-26-209-04
Security News Coverage
medium.com
Sources: Security News RSS, AWS, Microsoft MSRC, CISA (public domain), Metasploit/Nuclei

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-46300 ADVISORY https://seclists.org/oss-sec/2026/q3/11 ADVISORY https://ubuntu.com/security/notices/USN-8370-1 ADVISORY https://ubuntu.com/security/notices/USN-8371-1 ADVISORY https://vuldb.com/vuln/363802 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1899/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1900/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1904/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1907/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1908/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1909/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1959/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1978/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21645/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21646/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21673/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21684/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21689/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21690/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21718/ REF http://www.openwall.com/lists/oss-security/2026/05/13/5 REF http://www.openwall.com/lists/oss-security/2026/05/21/11 REF http://www.openwall.com/lists/oss-security/2026/05/21/12 REF http://www.openwall.com/lists/oss-security/2026/05/21/13 REF https://access.redhat.com/errata/RHBA-2026:20032 REF https://access.redhat.com/errata/RHSA-2026:19521 REF https://access.redhat.com/errata/RHSA-2026:19540 REF https://access.redhat.com/errata/RHSA-2026:19568 REF https://access.redhat.com/errata/RHSA-2026:19569 REF https://access.redhat.com/errata/RHSA-2026:19664 REF https://access.redhat.com/errata/RHSA-2026:19666 REF https://access.redhat.com/errata/RHSA-2026:19705 REF https://access.redhat.com/errata/RHSA-2026:19711 REF https://access.redhat.com/errata/RHSA-2026:19875 REF https://access.redhat.com/errata/RHSA-2026:20051 REF https://access.redhat.com/errata/RHSA-2026:20054 REF https://access.redhat.com/errata/RHSA-2026:20087 REF https://access.redhat.com/errata/RHSA-2026:20129 REF https://access.redhat.com/errata/RHSA-2026:20130 REF https://access.redhat.com/errata/RHSA-2026:20299 REF https://access.redhat.com/errata/RHSA-2026:20593 REF https://access.redhat.com/errata/RHSA-2026:21656 REF https://access.redhat.com/errata/RHSA-2026:21690 REF https://access.redhat.com/errata/RHSA-2026:21695 REF https://access.redhat.com/errata/RHSA-2026:21702 REF https://access.redhat.com/errata/RHSA-2026:23233 REF https://access.redhat.com/errata/RHSA-2026:23240 REF https://access.redhat.com/errata/RHSA-2026:23245 REF https://access.redhat.com/errata/RHSA-2026:23468 REF https://access.redhat.com/errata/RHSA-2026:23469 REF https://access.redhat.com/errata/RHSA-2026:23470 REF https://access.redhat.com/errata/RHSA-2026:23471 REF https://access.redhat.com/errata/RHSA-2026:24814 REF https://access.redhat.com/errata/RHSA-2026:25044 REF https://access.redhat.com/errata/RHSA-2026:28887 REF https://access.redhat.com/errata/RHSA-2026:33486 REF https://access.redhat.com/errata/RHSA-2026:34098 REF https://access.redhat.com/security/cve/CVE-2026-46300 REF https://bugzilla.redhat.com/show_bug.cgi?id=2477015 REF https://cert-portal.siemens.com/productcert/html/ssa-019113.html REF https://cert-portal.siemens.com/productcert/html/ssa-082556.html REF https://git.kernel.org/stable/c/2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c REF https://git.kernel.org/stable/c/3599e6b3cc1ada96883d496a50a210d3afbb6987 REF https://git.kernel.org/stable/c/3884358a9286b17f389a72b1426fc4547c23c111 REF https://git.kernel.org/stable/c/3bd9e113d50034db99d7ef69fd8e5242d15e414a REF https://git.kernel.org/stable/c/760e1addc27ba1a7beb4a0a7e8b3e9ec49e7a34e REF https://git.kernel.org/stable/c/78bf6b6bb19541d19fbda6242e7cfe2c682763c0 REF https://git.kernel.org/stable/c/9d3e5fd19fe1063bf607219e8562fbd567b8e8d5 REF https://git.kernel.org/stable/c/f84eca5817390257cef78013d0112481c503b4a3 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46300.json REF https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-46300

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy