CVE-2026-46300 Exploit Metadata

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Analysisdeepseek-v4-pro:cloud · 2026-08-08

Technical assessment

Metasploit local privilege escalation module that exploits CVE-2026-46300 by overwriting page-cache-backed pages of a setuid binary with attacker-controlled payload bytes, then executing the patched binary to gain elevated privileges.

Backdoor review

No backdoor observed in reviewed code

The reviewed Metasploit module source code implements a local privilege escalation exploit for CVE-2026-46300. It writes a payload to a file, runs an exploit binary to patch a setuid binary in memory, and executes the patched binary. No backdoor, deceptive payload, or concealed operator-directed harm was observed in the supplied evidence.

ClassificationExploit

Model confidence100%

AuthenticationRequired

Languagesruby

Target softwareLinux kernel

Attack typeslocal_privilege_escalation

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The module is a Metasploit exploit that actively exercises CVE-2026-46300 to overwrite a setuid binary's in-memory pages and execute a payload for privilege escalation.

modules/exploits/linux/local/cve_2026_46300_fragnesia.rb:6modules/exploits/linux/local/cve_2026_46300_fragnesia.rb:26-35modules/exploits/linux/local/cve_2026_46300_fragnesia.rb:140-148

Requirements

Unprivileged local shell or meterpreter session on a vulnerable Linux host.modules/exploits/linux/local/cve_2026_46300_fragnesia.rb:50
Kernel version >= 4.10 and vulnerable to CVE-2026-46300 (shared-frag marker lost during TCP coalescing).modules/exploits/linux/local/cve_2026_46300_fragnesia.rb:85
Vulnerable kernel modules (esp, ipcomp) must be loaded.modules/exploits/linux/local/cve_2026_46300_fragnesia.rb:79-81
A setuid binary (default /usr/bin/su) must exist and be at least as large as the generated payload ELF.modules/exploits/linux/local/cve_2026_46300_fragnesia.rb:98modules/exploits/linux/local/cve_2026_46300_fragnesia.rb:137
Writable directory on target (default /tmp).modules/exploits/linux/local/cve_2026_46300_fragnesia.rb:100-101
On Ubuntu, unprivileged user namespaces must be allowed (kernel.apparmor_restrict_unprivileged_userns=0).modules/exploits/linux/local/cve_2026_46300_fragnesia.rb:74-76

Observed behavior

Checks for dirty-frag mitigations, vulnerable kernel modules, kernel version, and Ubuntu userns restrictions.modules/exploits/linux/local/cve_2026_46300_fragnesia.rb:66-88
Generates a setuid payload ELF and uploads a compiled exploit binary (live compile or precompiled) to the target.modules/exploits/linux/local/cve_2026_46300_fragnesia.rb:107-125
Executes the exploit binary, piping the base64-encoded payload ELF to it, which overwrites in-memory page-cache pages of the setuid binary.modules/exploits/linux/local/cve_2026_46300_fragnesia.rb:140
Runs the now-patched setuid binary to execute the payload with elevated privileges.modules/exploits/linux/local/cve_2026_46300_fragnesia.rb:148
On new session, drops page cache to restore original file contents.modules/exploits/linux/local/cve_2026_46300_fragnesia.rb:151-157

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior: Local privilege escalation via in-memory patching of a setuid binaryThe module drops an exploit binary, uses it to overwrite in-memory pages of a setuid file with attacker-controlled payload, then executes the patched binary to gain elevated privileges.modules/exploits/linux/local/cve_2026_46300_fragnesia.rb:140-148
Payload Execution: Executes attacker-supplied payload via patched setuid binaryThe module generates an ELF payload with PrependSetuid, writes it to the target, and executes the patched setuid binary to run the payload with elevated privileges.modules/exploits/linux/local/cve_2026_46300_fragnesia.rb:107-112modules/exploits/linux/local/cve_2026_46300_fragnesia.rb:140-148
Cleanup Behavior: Drops page cache after exploitationThe on_new_session callback executes 'echo 1 | tee /proc/sys/vm/drop_caches' to clear page cache, likely to restore the original setuid binary content on disk.modules/exploits/linux/local/cve_2026_46300_fragnesia.rb:151-157

Review boundaries

What the analysis did not establish

Only the Metasploit module source is provided; the compiled exploit binary (cve-2026-46300.c) and precompiled binaries are referenced but not included.
Framework mixins, libraries, and external payloads are not expanded, so full exploit logic is partially opaque.
The review covers only the module source code; the external exploit binary (cve-2026-46300.c or precompiled binaries) is not included in the evidence and was not analyzed.
Metasploit framework mixins, libraries, and payloads are not expanded in the evidence; their behavior is assumed to be standard.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

CVE-2026-46300