NOTABLECVE-2026-46300vulnerability

CVE-2026-46300 — Linux kernel xfrm ESP-in-TCP LPE ("Fragnesia"), PoC public

discovered 2026-05-11 05:00 UTCrun 2026-W20-71c96b251 sourcesingle-source

Disclosed 2026-05-15 with public PoC; mainline kernel patch landed 2026-05-14, distro propagation underway. LPE primitive against the xfrm ESP-in-TCP code path; trips IPsec VPN endpoints in particular. Mitigation modprobe -r esp4 esp6 (breaks IPsec). Distinct from Dirty Frag (different code paths) but conceptually adjacent — both abuse kernel xfrm assumptions (daily 2026-05-15).

Sources

Linux kernel security advisory CVE-2026-46300primary

PROVENANCE

AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.