CVE-2026-46300: net: skbuff: preserve shared-frag marker during coalescing

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: yes — in CISA KEV since 2026-10-28
EPSS: 15.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-05-23 · updated 2026-10-29
Weakness: CWE-787

Description

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.

Summary

CVE-2026-46300 is a Linux kernel flaw in skb_try_coalesce() where the SKBFL_SHARED_FRAG marker is lost when paged frags are moved during TCP receive coalescing. This can cause ESP input to skip skb_cow_data() and decrypt in place over page-cache-backed frags, corrupting shared data (CVSS 7.8, high). It affects the Linux kernel and is fixed in 7.1 and in 5.15.208, 6.1.174, 6.12.91, and 6.18.33. CISA lists it as actively exploited with a public exploit or detection template available, so apply the fixed kernel versions or vendor mitigations promptly per BOD 26-04.

CVE-2026-46300 ثغرة في نواة Linux داخل الدالة skb_try_coalesce() حيث تُفقد العلامة SKBFL_SHARED_FRAG عند نقل المقاطع المُصفّحة أثناء دمج استقبال TCP. وقد يؤدي ذلك إلى أن يتخطى مسار ESP الدالة skb_cow_data() فيُجري فك التشفير في المكان فوق مقاطع مدعومة بذاكرة صفحة التخزين المؤقت، ما يفسد بيانات مشتركة (CVSS 7.8، خطورة عالية). تتأثر نواة Linux، وقد أُصلحت في 7.1 وفي 5.15.208 و6.1.174 و6.12.91 و6.18.33. تُدرج CISA الثغرة ضمن المستغلة فعلياً مع توفر استغلال عام أو قالب كشف، لذا طبّق إصدارات النواة المُصلحة أو تخفيفات المورّد فوراً وفق BOD 26-04.

Affected products

Linux kernel: from 3.9 through 5.10.257; from 5.11 before 5.15.208; from 5.16 before 6.1.174; from 6.2 before 6.6.141; from 6.7 before 6.12.91; from 6.13 before 6.18.33 — fixed in 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10
Red Hat Enterprise Linux: 6.0, 7.0, 8.0, 9.0, 10.0 (and their updates)
RedHat Enterprise Linux Aus: 8.4, 8.6 (and their updates)
RedHat Enterprise Linux Eus: 8.4, 9.4, 9.6, 10.0 (and their updates)
RedHat Enterprise Linux Tus: 8.6, 8.8 (and their updates)
RedHat Enterprise Linux Update Services For Sap Solutions: 8.6, 8.8, 9.0, 9.2, 9.4 (and their updates)
Red Hat OpenShift Container Platform 4.18: from 4.12 before 4.12.91; from 4.13 before 4.13.67; from 4.14 before 4.14.68; from 4.15 before 4.15.65; from 4.16 before 4.16.63; from 4.17 before 4.17.55 — fixed in 4.12.91, 4.13.67, 4.14.68, 4.15.65, 4.16.63, 4.17.55
Siemens Simatic S7-1500 Cpu 1518-4 Pn/Dp Mfp Firmware: from 3.1.5 through 3.1.6
Linux: 3.9 — fixed in 7.1

How to fix

Upgrade to a fixed version: Linux kernel 5.15.208, 6.1.174, 6.6.141, 6.12.91; Red Hat OpenShift Container Platform 4.18 4.12.91, 4.13.67, 4.14.68, 4.15.65; Linux 7.1. Check the vendor advisory for mitigations.

In the news

References

Get alerted when CVE-2026-46300 or the next vulnerability affects your stack