---
id: "CVE-2026-46300"
kind: "vulnerability"
aliases: ["CVE-2026-46300"]
title: "In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during\u2026"
severity: "high"
cvss: 7.8
epss: 0.10192
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "linux kernel", "fixed": [], "affected": ">= 3.9, <= 5.10.257", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": ["5.15.208"], "affected": ">= 5.11, < 5.15.208", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": ["6.1.174"], "affected": ">= 5.16, < 6.1.174", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": ["6.6.141"], "affected": ">= 6.2, < 6.6.141", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": ["6.12.91"], "affected": ">= 6.7, < 6.12.91", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": ["6.18.33"], "affected": ">= 6.13, < 6.18.33", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": ["7.0.10"], "affected": ">= 6.19, < 7.0.10", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": [], "affected": "= 7.1", "ecosystem": "vendor"}, {"name": "Linux Kernel", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "infrastructure", "ipsec", "linux-kernel", "self-hosted"]
not_affected_if: ["default-config"]
published_at: "2026-05-23T12:17:02+00:00"
first_seen_at: "2026-10-28T20:01:38+00:00"
updated_at: "2026-10-28T21:01:52+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-46300", "first_seen_at": "2026-10-28T20:01:38+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46300", "first_seen_at": "2026-10-28T20:05:07+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-46300", "first_seen_at": "2026-10-28T20:59:22+00:00"}]
---

# In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during…

A missing variable initialization in the Linux kernel's socket buffer coalescing drops the shared-fragment marker, so ESP input processing can decrypt shared page-cache fragments in place. An attacker can modify cached file data and, per CISA's notice, chain it with two other flaws to plant PHP webshells and run commands as root.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:linux kernel affected >= 3.9, <= 5.10.257 fixed ?
- vendor:linux kernel affected >= 5.11, < 5.15.208 fixed 5.15.208
- vendor:linux kernel affected >= 5.16, < 6.1.174 fixed 6.1.174
- vendor:linux kernel affected >= 6.2, < 6.6.141 fixed 6.6.141
- vendor:linux kernel affected >= 6.7, < 6.12.91 fixed 6.12.91
- vendor:linux kernel affected >= 6.13, < 6.18.33 fixed 6.18.33
- vendor:linux kernel affected >= 6.19, < 7.0.10 fixed 7.0.10
- vendor:linux kernel affected = 7.1 fixed ?
- vendor:Linux Kernel affected ? fixed ?

## How to check

- unknown

## Fix

- Apply the kernel update from your distribution that includes the fix for CVE-2026-46300, per vendor instructions.
- If no fix is available, follow CISA BOD 26-04 guidance or stop using the affected product.

## Timeline

- 2026-10-28T20:01:38+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-46300
- 2026-10-28T20:05:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-46300
- 2026-10-28T20:59:22+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-46300

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

net: skbuff: preserve shared-frag marker during coalescing

skb_try_coalesce() can attach paged frags from @from to @to.  If @from
has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same
externally-owned or page-cache-backed frags, but the shared-frag marker
is currently lost.

That breaks the invariant relied on by later in-place writers.  In
particular, ESP input checks skb_has_shared_frag() before deciding
whether an uncloned nonlinear skb can skip skb_cow_data().  If TCP
receive coalescing has moved shared frags into an unmarked skb, ESP can
see skb_has_shared_frag() as false and decrypt in place over page-cache
backed frags.

Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged
frags.  The tailroom copy path does not need the marker because it copies
bytes into @to's linear data rather than transferring frag descriptors.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_