CVE-2026-46300

🛡️ CVE-2026-46300 - Fragnesia A Clean & Deadly Page-Cache Attack Variant of the "Dirty Frag" family 📌 Overview CVE-2026-46300 Fragnesia is a high-severity logic flaw in the Linux kernel's socket buffer handling skbtrycoalesce within the XFRM/ESP-in-TCP subsystem espintcp ULP. An unprivileged local...

CVE-2026-98417

A flaw was found in the Linux kernel's XFRM IPsec encryption framework subsystem. A remote attacker could exploit this issue by sending specially crafted ESP-in-TCP Encapsulating Security Payload over Transmission Control Protocol packets with invalid transport header offsets. This improper...

Fragnesia-go

fragnesia-go One SA. One byte at a time. No race. Go port of fragnesia CVE-2026-46300. Member of the Dirty Frag vulnerability class - separate bug, same surface, own patch. How it works tl;dr The bug is in the Linux XFRM ESP-in-TCP subsystem. When TCPULP espintcp is installed on a socket after da...

CVE-2026-98417

In the Linux kernel, the following vulnerability has been resolved: net: xfrm: reject unrepresentable espintcp transport headers ESP-in-TCP can hand xfrm packets whose transport header offset no longer fits after the stream parser trims the TCP envelope. The plain transport header reset truncates...

CVE-2026-46300

CVE-KERNEL · Linux Kernel LPE Chain Multi-CVE Local Privilege Escalation chain for Linux kernel vulnerabilities uid=1000 → root via xfrm-ESP, RxRPC, or Fragnesia page-cache write Overview CVE-KERNEL is a Python-based Local Privilege Escalation LPE tool that chains multiple Linux kernel CVEs to...

CVE-2026-46300-Fragnesia---TryHackMe-Lab-Project

CVE-2026-46300-Fragnesia---TryHackMe-Lab-Project The project documents the completion and analysis of the Fragnesia CVE-2026-46300 TryHackME lab, which demonstrates a Linux kernel page -cache corruption vulnerability capable of achieving local privilege escalation through modification of cached...

Ubuntu 14.04 LTS : Linux kernel (Azure) vulnerabilities (USN-8635-1)

"The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8635-1 advisory. Siebe Devroe, Hlose Gollier, and Mathy Vanhoef discovered that the WiFi implementation in the Linux kernel did not properly handle aggregated frames in...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: xfrm: Dropping ESP-in-TCP packets when no ingress device is available. ESP-in-TCP processes records through the tcpstrparser. The handleesp function retrieves skb-dev from the saved skbiif before passing the packet into the XFRM...

SUSE CVE-2026-80846

In the Linux kernel, the following vulnerability has been resolved: xfrm: drop ESP-in-TCP packets with no ingress device ESP-in-TCP receives records through the TCP strparser. handleesp restores skb-dev from the saved skbiif before passing the packet into the XFRM input path. Queued TCP data can ...

AZL-99431 CVE-2026-80846 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: xfrm: drop ESP-in-TCP packets with no ingress device ESP-in-TCP receives records through the TCP strparser. handleesp restores skb-dev from the saved skbiif before passing the packet into the XFRM input path. Queued TCP data can ...

CVE-2026-80846

In the Linux kernel, the following vulnerability has been resolved: xfrm: drop ESP-in-TCP packets with no ingress device ESP-in-TCP receives records through the TCP strparser. handleesp restores skb-dev from the saved skbiif before passing the packet into the XFRM input path. Queued TCP data can ...

EUVD-2026-71296

In the Linux kernel, the following vulnerability has been resolved: xfrm: drop ESP-in-TCP packets with no ingress device ESP-in-TCP receives records through the TCP strparser. handleesp restores skb-dev from the saved skbiif before passing the packet into the XFRM input path. Queued TCP data can ...

CVE-2026-80846 xfrm: drop ESP-in-TCP packets with no ingress device

In the Linux kernel, the following vulnerability has been resolved: xfrm: drop ESP-in-TCP packets with no ingress device ESP-in-TCP receives records through the TCP strparser. handleesp restores skb-dev from the saved skbiif before passing the packet into the XFRM input path. Queued TCP data can ...

CVE-2026-80846 xfrm: drop ESP-in-TCP packets with no ingress device

In the Linux kernel, the following vulnerability has been resolved: xfrm: drop ESP-in-TCP packets with no ingress device ESP-in-TCP receives records through the TCP strparser. handleesp restores skb-dev from the saved skbiif before passing the packet into the XFRM input path. Queued TCP data can ...

CVE-2026-80846

In the Linux kernel, the following vulnerability has been resolved: xfrm: drop ESP-in-TCP packets with no ingress device ESP-in-TCP receives records through the TCP strparser. handleesp restores skb-dev from the saved skbiif before passing the packet into the XFRM input path. Queued TCP data can ...

CVE-2026-80846

CVE-2026-80846 is a NULL pointer dereference in the Linux kernel affecting the XFRM ESP-in-TCP path. When queued TCP data is processed after the original ingress device has been removed (e.g., during veth or network namespace teardown), handle_esp() restores skb->dev from the saved skb_iif, bu...

PT-2026-85724

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the XFRM implementation where ESP-in-TCP records are processed via the TCP strparser. The handle esp function restores skb-dev from the saved skb iif before the packet...

PT-2026-91308

In the Linux kernel, the following vulnerability has been resolved: xfrm: drop ESP-in-TCP packets with no ingress device ESP-in-TCP receives records through the TCP strparser. handle esp restores skb-dev from the saved skb iif before passing the packet into the XFRM input path. Queued TCP data ca...

CVE-2026-80846: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: xfrm: drop ESP-in-TCP packets with no ingress device ESP-in-TCP receives records through the TCP strparser. handleesp restores skb-dev from the saved skbiif before passing the packet into the XFRM input path. Queued TCP data can ...

Linux Distros Unpatched Vulnerability : CVE-2026-80846

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfrm: drop ESP-in-TCP packets with no ingress device ESP-in-TCP receives records through the TCP strparser. handleesp restores skb-dev from the saved skbiif...