Strix
75.1K

CVE-2026-46300

HIGHCVSS 7.8/10Actively ExploitedEPSS 15.72%

Last modified

CVE-2026-46300 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. CISA has confirmed active exploitation in the wild. EPSS estimates a 15.72% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.

Metrics

CVSS 3.1
7.8/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
15.72%

96.9th percentile

Probability of exploitation in the next 30 days. Learn more

Exploitation Status

This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .

Weakness Enumeration

Affected Software

VendorProductVersionsUpdate
LinuxLinux Kernel>= 3.9, <= 5.10.257—
LinuxLinux Kernel>= 5.11, < 5.15.208—
LinuxLinux Kernel>= 5.16, < 6.1.174—
LinuxLinux Kernel>= 6.2, < 6.6.141—
LinuxLinux Kernel>= 6.7, < 6.12.91—
LinuxLinux Kernel>= 6.13, < 6.18.33—
LinuxLinux Kernel>= 6.19, < 7.0.10—
LinuxLinux Kernel7.1Rc1
SiemensSimatic S7-1500 Cpu 1518-4 Pn\/Dp Mfp Firmware>= 3.1.5, <= 3.1.6—
RedhatOpenshift Container Platform>= 4.12, < 4.12.91—
RedhatOpenshift Container Platform>= 4.13, < 4.13.67—
RedhatOpenshift Container Platform>= 4.14, < 4.14.68—
RedhatOpenshift Container Platform>= 4.15, < 4.15.65—
RedhatOpenshift Container Platform>= 4.16, < 4.16.63—
RedhatOpenshift Container Platform>= 4.17, < 4.17.55—
RedhatOpenshift Container Platform>= 4.18, < 4.18.43—
RedhatOpenshift Container Platform>= 4.19, < 4.19.33—
RedhatOpenshift Container Platform>= 4.20, < 4.20.24—
RedhatOpenshift Container Platform>= 4.21, < 4.21.17—
RedhatEnterprise Linux6.0—
RedhatEnterprise Linux7.0—
RedhatEnterprise Linux8.0—
RedhatEnterprise Linux9.0—
RedhatEnterprise Linux10.0—
RedhatEnterprise Linux Aus8.4—
RedhatEnterprise Linux Aus8.6—
RedhatEnterprise Linux Eus8.4—
RedhatEnterprise Linux Eus9.4—
RedhatEnterprise Linux Eus9.6—
RedhatEnterprise Linux Eus10.0—
RedhatEnterprise Linux Tus8.6—
RedhatEnterprise Linux Tus8.8—
RedhatEnterprise Linux Update Services For Sap Solutions8.6—
RedhatEnterprise Linux Update Services For Sap Solutions8.8—
RedhatEnterprise Linux Update Services For Sap Solutions9.0—
RedhatEnterprise Linux Update Services For Sap Solutions9.2—
RedhatEnterprise Linux Update Services For Sap Solutions9.4—

References

Timeline

Published
Last Modified
Status
Analyzed

Frequently Asked Questions

What is CVE-2026-46300?
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.
How severe is CVE-2026-46300?
CVE-2026-46300 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 15.72% probability of exploitation in the next 30 days. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
How do I fix CVE-2026-46300?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-46300?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST