CVE-2026-46300: Linux Kernel Use-After-Free Vulnerability

CVE-2026-46300 Overview

CVE-2026-46300 is a Linux kernel vulnerability in the network socket buffer (skb) subsystem. The flaw resides in skb_try_coalesce(), which fails to preserve the SKBFL_SHARED_FRAG marker when transferring paged fragments between socket buffers. This breaks an invariant that later in-place writers depend on, particularly the IPsec ESP input path. When TCP receive coalescing moves shared frags into an unmarked skb, ESP can incorrectly skip skb_cow_data() and decrypt in place over page-cache backed frags. The issue is classified as [CWE-787] (Out-of-bounds Write) and affects multiple Linux kernel branches including 7.1 release candidates.

Critical Impact
A local attacker with low privileges can trigger memory corruption in page-cache backed fragments through the ESP input path, leading to potential confidentiality, integrity, and availability impact on the host.

Affected Products

Linux Kernel (multiple stable branches)
Linux Kernel 7.1-rc1 through 7.1-rc4
Systems using IPsec ESP with TCP receive coalescing

Discovery Timeline

2026-05-23 - CVE-2026-46300 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-46300

Vulnerability Analysis

The vulnerability stems from incorrect flag propagation during socket buffer coalescing in the Linux networking stack. The function skb_try_coalesce() attaches paged fragments from a source skb (@from) to a destination skb (@to). When the source has the SKBFL_SHARED_FRAG flag set, the destination inherits the externally-owned or page-cache-backed fragments but loses the shared-frag marker.

This broken invariant has direct downstream consequences. The IPsec ESP input handler calls skb_has_shared_frag() to determine whether an uncloned nonlinear skb can safely bypass skb_cow_data(). The latter function ensures the kernel owns a private, writable copy of the data before in-place cryptographic operations.

When TCP receive coalescing relocates shared frags into an unmarked skb, skb_has_shared_frag() returns false. ESP then proceeds to decrypt in place, writing plaintext over page-cache-backed memory that may be shared with other subsystems or processes. This results in out-of-bounds writes against memory the ESP path does not legitimately own.

Root Cause

The root cause is missing flag propagation logic in skb_try_coalesce(). The frag-transfer path moves fragment descriptors from @from to @to without copying the SKBFL_SHARED_FRAG bit. The tailroom copy path is unaffected because it copies bytes into the destination's linear data area rather than transferring frag descriptors.

Attack Vector

Exploitation requires local access with low privileges and no user interaction. An attacker establishes TCP traffic that triggers receive coalescing of shared fragments, then forces the ESP input path to process the coalesced skb. Because the shared-frag marker is lost, ESP decrypts in place over page-cache memory, corrupting data structures that other kernel paths or user processes rely on. The vulnerability is not network-reachable for remote attackers based on the local attack vector classification.

No verified public proof-of-concept code has been published. Refer to the Linux Kernel Commit 2f2b160 and related stable-tree commits for the authoritative fix.

Detection Methods for CVE-2026-46300

Indicators of Compromise

Unexpected memory corruption symptoms in processes accessing page-cache backed files on hosts using IPsec ESP
Kernel warnings or oopses originating from the net/ipv4/esp4.c or net/ipv6/esp6.c paths during heavy TCP receive coalescing
Anomalous ESP decryption failures or integrity check errors following coalesced TCP receive activity

Detection Strategies

Inventory Linux hosts and compare running kernel versions against the patched commit hashes published in the kernel stable tree
Audit systems with IPsec ESP enabled in combination with TCP-based workloads, as these are the primary exposure surface
Monitor kernel logs for skb-related warnings, ESP decryption errors, and unexpected page-cache integrity events

Monitoring Recommendations

Collect kernel ring buffer (dmesg) and journalctl -k output centrally for correlation across the fleet
Track IPsec-related counters in /proc/net/xfrm_stat and ESP error metrics for anomalous trends
Alert on local privilege escalation indicators and unexpected process crashes on IPsec gateways and VPN concentrators

How to Mitigate CVE-2026-46300

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable-tree commits, including Linux Kernel Commit 2f2b160 and Linux Kernel Commit f84eca58
Prioritize patching on IPsec gateways, VPN concentrators, and multi-tenant hosts where local users are present
Subscribe to your Linux distribution's security advisories to receive backported kernel updates

Patch Information

The fix propagates SKBFL_SHARED_FRAG from @from to @to when skb_try_coalesce() transfers paged frags, restoring the invariant relied on by skb_has_shared_frag() consumers. Patches have been merged across multiple stable branches. Reference commits include 2f2b16022a2e, 3599e6b3cc1a, 3884358a9286, 3bd9e113d500, 760e1addc27b, 78bf6b6bb195, 9d3e5fd19fe1, and f84eca581739. Additional discussion is available in the OpenWall OSS Security Update 2026-05-13.

Workarounds

Disable IPsec ESP on systems that do not require it until patches can be applied
Restrict local user access on systems where ESP and TCP coalescing are both active
Consider disabling TCP receive coalescing (GRO) on affected interfaces as a temporary measure, accepting the performance trade-off

bash

# Verify running kernel version and check for the fix
uname -r

# Temporarily disable Generic Receive Offload on an interface
ethtool -K eth0 gro off

# Check IPsec ESP statistics for anomalies
cat /proc/net/xfrm_stat