CVE-2026-46300
net: skbuff: propagate shared-frag marker through frag-transfer helpers
Title source: cnaExploitation Summary
EIP tracks 7 public exploits for CVE-2026-46300. PoCs published by 0xBlackash, Sentebale, Koshmare-Blossom.
AI-analyzed exploit summary The repository contains a functional local privilege escalation exploit for CVE-2026-46300, leveraging a logic flaw in the Linux kernel's socket buffer handling within the XFRM/ESP-in-TCP subsystem to achieve arbitrary byte writes in the kernel page cache.
Description
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker through frag-transfer helpers Two frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) fail to propagate the SKBFL_SHARED_FRAG bit in skb_shinfo()->flags when moving frags from source to destination. __pskb_copy_fclone() defers the rest of the shinfo metadata to skb_copy_header() after copying frag descriptors, but that helper only carries over gso_{size,segs, type} and never touches skb_shinfo()->flags; skb_shift() moves frag descriptors directly and leaves flags untouched. As a result, the destination skb keeps a reference to the same externally-owned or page-cache-backed pages while reporting skb_has_shared_frag() as false. The mismatch is harmful in any in-place writer that uses skb_has_shared_frag() to decide whether shared pages must be detoured through skb_cow_data(). ESP input is one such writer (esp4.c, esp6.c), and a single nft 'dup to <local>' rule -- or any other nf_dup_ipv4() / xt_TEE caller -- is enough to land a pskb_copy()'d skb in esp_input() with the marker stripped, letting an unprivileged user write into the page cache of a root-owned read-only file via authencesn-ESN stray writes. Set SKBFL_SHARED_FRAG on the destination whenever frag descriptors were actually moved from the source. skb_copy() and skb_copy_expand() share skb_copy_header() too but linearize all paged data into freshly allocated head storage and emerge with nr_frags == 0, so skb_has_shared_frag() returns false on its own; they need no change. The same omission exists in skb_gro_receive() and skb_gro_receive_list(). The former moves the incoming skb's frag descriptors into the accumulator's last sub-skb via two paths (a direct frag-move loop and the head_frag + memcpy path); the latter chains the incoming skb whole onto p's frag_list. Downstream skb_segment() reads only skb_shinfo(p)->flags, and skb_segment_list() reuses each sub-skb's shinfo as the nskb -- both p and lp must carry the marker. The same omission also exists in tcp_clone_payload(), which builds an MTU probe skb by moving frag descriptors from skbs on sk_write_queue into a freshly allocated nskb. The helper falls into the same family and warrants the same fix for consistency; no TCP TX-side in-place writer is currently known to reach a user page through this gap, but a future consumer depending on the marker would regress silently. The same omission exists in skb_segment(): the per-iteration flag merge takes only head_skb's flag, and the inner switch that rebinds frag_skb to list_skb on head_skb-frags exhaustion does not fold the new frag_skb's flag into nskb. Fold frag_skb's flag at both sites so segments drawing frags from frag_list members carry the marker.
Exploits (7)
The repository contains a functional local privilege escalation exploit for CVE-2026-46300, leveraging a logic flaw in the Linux kernel's socket buffer handling within the XFRM/ESP-in-TCP subsystem to achieve arbitrary byte writes in the kernel page cache.
This PoC demonstrates a local privilege escalation (LPE) exploit leveraging Linux namespace isolation (CLONE_NEWUSER and CLONE_NEWNET) to gain root access. It uses unshare() to create new user and network namespaces, then spawns a shell with elevated privileges.
This repository contains a functional Go-based exploit for CVE-2026-46300, leveraging a Linux kernel vulnerability in the XFRM ESP-in-TCP subsystem to achieve local privilege escalation (LPE). The exploit uses a controlled single-byte write primitive via AES-GCM decryption in-place on page-cache pages, allowing arbitrary code execution as root.
This repository contains a Go-based tool that mitigates CVE-2026-43500 and CVE-2026-43284 by disabling vulnerable kernel modules (esp4, esp6, rxrpc) and applying kernel updates. It includes functionality to detect vulnerable modules, apply hotfixes, and clean up artifacts post-update.
This repository provides a detailed technical analysis of CVE-2026-46300, a local privilege escalation vulnerability in the Linux kernel's XFRM ESP-in-TCP subsystem. It includes root cause analysis, patch information, and remediation steps but does not contain exploit code.
The repository contains no actual exploit code, only a README with instructions to clone and run a non-existent 'exploit' file. This is a social engineering lure designed to trick users into downloading external content.
This repository contains a functional local privilege escalation (LPE) exploit for CVE-2026-46300, targeting a logic bug in the Linux XFRM ESP-in-TCP subsystem. The exploit achieves arbitrary byte writes into the kernel page cache of read-only files by manipulating the ESP-in-TCP ULP mode transition and AES-GCM keystream bytes.