Live › vulnerability › CVE-2026-46300
Go to dashboardA missing variable initialization in the Linux kernel's socket buffer coalescing drops the shared-fragment marker, so ESP input processing can decrypt shared page-cache fragments in place. An attacker can modify cached file data and, per CISA's notice, chain it with two other flaws to plant PHP webshells and run commands as root.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 20:01 UTC, 0h before NVD. All times on this page are UTC.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Systems running a Linux kernel with IPsec ESP processing that has not received the fix. Hosts that do not use ESP (IPsec) are less likely exposed, but the sources do not confirm a specific configuration requirement. Exposure of internet-facing servers should be evaluated per BOD 26-04.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| linux kernel | vendor | >= 3.9, <= 5.10.257 | – |
| linux kernel | vendor | >= 5.11, < 5.15.208 | 5.15.208 |
| linux kernel | vendor | >= 5.16, < 6.1.174 | 6.1.174 |
| linux kernel | vendor | >= 6.2, < 6.6.141 | 6.6.141 |
| linux kernel | vendor | >= 6.7, < 6.12.91 | 6.12.91 |
| linux kernel | vendor | >= 6.13, < 6.18.33 | 6.18.33 |
| linux kernel | vendor | >= 6.19, < 7.0.10 | 7.0.10 |
| linux kernel | vendor | = 7.1 | – |
| Linux Kernel | vendor | – | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
net: skbuff: preserve shared-frag marker during coalescing
skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost.
That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags.
Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.
This page as .md · .json · in your agent: get_signal("CVE-2026-46300")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.