CVE-2026-46300highunder attackCWE-123CWE-456

CVE-2026-46300: high-severity vulnerability in Linux

net: skbuff: preserve shared-frag marker during coalescing

Published · Updated

Follow this CVE+ Monitor Linux+ Monitor linux

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

91Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has an official Brazilian government alert and has a working public exploit.

ssvc Actcvss 7.8epss 16%
from disclosure to weaponsame day
Published on NVDMay 23
1st PoCMay 14
metasploitMay 14
CISA KEV+158d
Official alert in Brazil

Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.

  • CTIR Gov · ALERTA 103/2026 · 29 Oct 2026Vulnerabilidade crítica no Kernel - Linuxread on gov.br ↗
Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
Action required by CISAfederal deadline: 2026-10-31

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

In short

A flaw in the Linux kernel's network buffer handling can lose a marker that warns other code that some data is shared. This can cause the kernel to modify data it should have copied first, which may corrupt data that other parts of the system rely on.

Technical detail

In skb_try_coalesce(), paged fragments transferred from a source skb with SKBFL_SHARED_FRAG set are attached to the destination skb without propagating that flag. ESP input relies on skb_has_shared_frag() to skip skb_cow_data() for uncloned nonlinear skbs, so after TCP receive coalescing it can perform in-place decryption over page-cache-backed frags. The reported impact is unintended in-place writes to shared, externally owned memory, affecting integrity; the fix in the Linux kernel propagates the marker during frag transfer.

Summary generated and translated by AI from the official description.
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Linux · Linux
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Linux

In the same product, most dangerous first.

CVE-2026-31431HIGHcrypto: algif_aead - Revert to operating out-of-placeEPSS 98.1%KEVCVE-2024-53197HIGHALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devicesEPSS 4.1%KEVCVE-2024-53104HIGHmedia: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_formatEPSS 3.4%KEVCVE-2025-39682CRITICALtls: fix handling of zero-length records on the rx_listEPSS 3.3%KEVCVE-2024-36971HIGHnet: fix __dst_negative_advice() raceEPSS 2.7%KEVCVE-2025-39964HIGHcrypto: af_alg - Disallow concurrent writes in af_alg_sendmsgEPSS 1.6%KEV