CVE-2026-46300: Linux Kernel Privilege Escalation via Shared Fragment Handling

Overview

CVE-2026-46300 is a high-severity vulnerability in the Linux kernel affecting how shared fragments are handled during socket buffer coalescing. This flaw can lead to unintended modification of page-cache-backed data, specifically allowing ESP input processing to decrypt shared fragments in place. When chained with other vulnerabilities, this can enable privilege escalation, the implantation of PHP webshells, and arbitrary command execution as root, posing a significant threat to Linux-based systems, including IoT devices.

Technical Analysis

The vulnerability stems from a missing initialization of a variable within the skb_try_coalesce() function. When skb_try_coalesce() transfers paged fragments from one socket buffer (@from) to another (@to), it fails to preserve the SKBFL_SHARED_FRAG marker if @from had it set. This breaks an invariant relied upon by later in-place writers, particularly ESP input processing. Consequently, ESP input checks skb_has_shared_frag() and, if the marker is missing, incorrectly determines that an uncloned nonlinear skb can skip skb_cow_data(), leading to in-place decryption over page-cache backed fragments.

This unintended modification of page-cache-backed data can be leveraged for privilege escalation. The NVD record explicitly states that this vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and execute commands as root.

• CVSS 3.1 Score: 7.8 (High)
• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Weaknesses: CWE-787 (Out-of-bounds Write), CWE-456 (Missing Initialization of a Variable), CWE-123 (Write-what-where Condition)
• Affected Versions:
  • Linux kernel versions >= 3.9 and <= 5.10.257
  • Linux kernel versions >= 5.11 and < 5.15.208
  • Linux kernel versions >= 5.16 and < 6.1.174
  • Linux kernel versions >= 6.2 and < 6.6.141
  • Linux kernel versions >= 6.7 and < 6.12.91
  • Linux kernel versions >= 6.13 and < 6.18.33
  • Linux kernel versions >= 6.19 and < 7.0.10
  • Linux kernel version 7.1

Detection

Direct detection of the kernel vulnerability exploitation itself can be challenging from user-space logs. However, the post-exploitation activities described (webshells, root command execution) provide clear detection opportunities.

• Suspicious File Writes: Monitor web server directories (/var/www/, /srv/www/, /usr/share/nginx/html/, etc.) for the creation or modification of .php files by unusual processes or with suspicious content (e.g., base64 encoded strings, eval() functions). Utilize auditd logs for PATH events related to file creation/modification.
• Privileged Process Execution: Look for sh, bash, php, python, or perl being executed with root privileges (UID 0) by unexpected parent processes or in unusual contexts. This is particularly relevant if the parent process is a network service or a process that should not typically spawn shells. Monitor auditd logs for SYSCALL events related to execve.
• Network Activity: Monitor for unusual outbound connections from compromised systems, especially those indicative of botnet activity (e.g., DDoS attacks, C2 communications) if linked to malware families like KATARU or Mirai.

Sigma Detection Rules

Linux Webshell Creation in Web Directories

title: Linux Webshell Creation in Web Directories
id: 752a1b3e-f1c3-4d0a-b8e7-2c9f0e1d4a3b
status: experimental
description: Detects the creation or modification of .php files in common web server directories, indicative of webshell deployment after exploitation.
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: 'PATH'
    name|endswith:
      - '.php'
      - '.phtml'
      - '.phar'
    # Common web server root directories
    directory|contains:
      - '/var/www/'
      - '/srv/www/'
      - '/usr/share/nginx/html/'
      - '/var/www/html/'
      - '/var/www/htdocs/'
  condition: selection
level: high

Linux Suspicious Root Command Execution

title: Linux Suspicious Root Command Execution
id: 9e0c3f1a-5b6d-4e7c-8a2b-1d0f2e3c4b5a
status: experimental
description: Detects execution of common shell or scripting interpreters with root privileges, which could indicate successful privilege escalation.
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: 'SYSCALL'
    a0|contains:
      - '/bin/sh'
      - '/bin/bash'
      - '/usr/bin/php'
      - '/usr/bin/python'
      - '/usr/bin/perl'
    uid: '0' # Root user
  condition: selection
level: high

Mitigations

1. Apply Kernel Patches: Immediately update Linux kernel to a version that includes the fix for CVE-2026-46300. Refer to the provided kernel Git references for specific patch details.
2. Regular System Updates: Ensure all Linux-based systems, including IoT devices, are kept up-to-date with the latest security patches from their respective distributions.
3. Principle of Least Privilege: Restrict user and process privileges to the absolute minimum required to perform their functions.
4. Network Segmentation: Isolate critical systems and IoT devices on separate network segments to limit lateral movement in case of compromise.
5. Web Server Hardening: Implement strong web server security configurations, including disabling unnecessary PHP functions, restricting write access to web directories, and using Web Application Firewalls (WAFs).

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-46300
• https://git.kernel.org/stable/c/2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c
• https://git.kernel.org/stable/c/3599e6b3cc1ada96883d496a50a210d3afbb6987
• https://git.kernel.org/stable/c/3884358a9286b17f389a72b1426fc4547c23c111
• https://git.kernel.org/stable/c/3bd9e113d50034db99d7ef69fd8e5242d15e414a
• https://git.kernel.org/stable/c/760e1addc27ba1a7beb4a0a7e8b3e9ec49e7a34e
• https://git.kernel.org/stable/c/78bf6b6bb19541d19fbda6242e7cfe2c682763c0
• https://git.kernel.org/stable/c/9d3e5fd19fe1063bf607219e8562fbd567b8e8d5
• https://git.kernel.org/stable/c/f84eca5817390257cef78013d0112481c503b4a3
• https://www.nozominetworks.com/blog/kataru-iot-malware-adopts-public-lpe-exploits
• https://ltna.com.au/cyber

Indicators of Compromise

MITRE ATT&CK

• T1068 — Exploitation for Privilege Escalation
• T1505.003 — Web Shell
• T1059 — Command and Scripting Interpreter
• T1110.001 — Password Guessing
• T1498.001 — Direct Network Flood
• T1053.003 — Cron
• T1082 — System Information Discovery
• T1499.002 — Service Exhaustion Flood
• T1106 — Native API
• T1016 — System Network Configuration Discovery
• T1059.004 — Unix Shell
• T1562.001 — Disable or Modify Tools
• T1027 — Obfuscated Files or Information
• T1573.002 — Asymmetric Cryptography
• T1095 — Non-Application Layer Protocol
• T1037.004 — RC Scripts
• T1543.002 — Systemd Service
• T1105 — Ingress Tool Transfer