Skip to content

CVE-2026-46300 net: skbuff: preserve shared-frag marker during coalescing

HighCVSS 7.8 EPSS 16.1% CISA KEV added 2026-10-28 · due 2026-10-31 Exploited in the wild Framework module Public exploit
Published
Updated
Exploit status
Exploited in the wild (confirmed)

Description

In the Linux kernel, the following vulnerability has been resolved:

net: skbuff: preserve shared-frag marker during coalescing

skb_try_coalesce() can attach paged frags from @from to @to. If @from
has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same
externally-owned or page-cache-backed frags, but the shared-frag marker
is currently lost.

That breaks the invariant relied on by later in-place writers. In
particular, ESP input checks skb_has_shared_frag() before deciding
whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP
receive coalescing has moved shared frags into an unmarked skb, ESP can
see skb_has_shared_frag() as false and decrypt in place over page-cache
backed frags.

Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged
frags. The tailroom copy path does not need the marker because it copies
bytes into @to's linear data rather than transferring frag descriptors.

CISA Known Exploited Vulnerability

Date added
2026-10-28
Due date (FCEB)
2026-10-31
Ransomware use
Unknown

Required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Affected products

ProductAffected versionsFixed in
Linux kernel >= cef401de7be8c4e155c6746bfccf721a4fa5fab9, < 3599e6b3cc1ada96883d496a50a210d3afbb6987 3599e6b3cc1ada96883d496a50a210d3afbb6987
Linux kernel >= cef401de7be8c4e155c6746bfccf721a4fa5fab9, < 2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c 2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c
Linux kernel >= cef401de7be8c4e155c6746bfccf721a4fa5fab9, < 9d3e5fd19fe1063bf607219e8562fbd567b8e8d5 9d3e5fd19fe1063bf607219e8562fbd567b8e8d5
Linux kernel >= cef401de7be8c4e155c6746bfccf721a4fa5fab9, < 78bf6b6bb19541d19fbda6242e7cfe2c682763c0 78bf6b6bb19541d19fbda6242e7cfe2c682763c0
Linux kernel >= cef401de7be8c4e155c6746bfccf721a4fa5fab9, < 760e1addc27ba1a7beb4a0a7e8b3e9ec49e7a34e 760e1addc27ba1a7beb4a0a7e8b3e9ec49e7a34e
Linux kernel >= cef401de7be8c4e155c6746bfccf721a4fa5fab9, < 3bd9e113d50034db99d7ef69fd8e5242d15e414a 3bd9e113d50034db99d7ef69fd8e5242d15e414a
Linux kernel >= cef401de7be8c4e155c6746bfccf721a4fa5fab9, < 3884358a9286b17f389a72b1426fc4547c23c111 3884358a9286b17f389a72b1426fc4547c23c111
Linux kernel >= cef401de7be8c4e155c6746bfccf721a4fa5fab9, < f84eca5817390257cef78013d0112481c503b4a3 f84eca5817390257cef78013d0112481c503b4a3
Linux kernel = 3.9 No fix listed
Linux kernel < 5.10.257 5.10.257
Linux kernel < 5.15.208 5.15.208
Linux kernel < 6.1.174 6.1.174
Linux kernel < 6.6.141 6.6.141
Linux kernel < 6.12.91 6.12.91
Linux kernel < 6.18.33 6.18.33
Linux kernel < 7.0.10 7.0.10
Linux kernel < 7.1 7.1
redhat enterprise linux nvidia < 0:6.12.0-211.8.el10nv 0:6.12.0-211.8.el10nv
redhat enterprise linux nvidia < 0:6.12.0-231.12.el10nv 0:6.12.0-231.12.el10nv
redhat enterprise linux < 0:6.12.0-211.16.1.el10_2 0:6.12.0-211.16.1.el10_2
redhat enterprise linux eus < 0:6.12.0-55.75.1.el10_0 0:6.12.0-55.75.1.el10_0
redhat enterprise linux < 0:4.18.0-553.125.1.rt7.466.el8_10 0:4.18.0-553.125.1.rt7.466.el8_10
redhat enterprise linux < 0:4.18.0-553.125.1.el8_10 0:4.18.0-553.125.1.el8_10
redhat enterprise linux = 8 No fix listed
redhat rhel aus < 0:4.18.0-305.192.1.el8_4 0:4.18.0-305.192.1.el8_4
Show 175 more
ProductAffected versionsFixed in
redhat rhel eus long life < 0:4.18.0-305.192.1.el8_4 0:4.18.0-305.192.1.el8_4
redhat rhel aus < 0:4.18.0-372.193.1.el8_6 0:4.18.0-372.193.1.el8_6
redhat rhel tus < 0:4.18.0-372.193.1.el8_6 0:4.18.0-372.193.1.el8_6
redhat rhel e4s < 0:4.18.0-372.193.1.el8_6 0:4.18.0-372.193.1.el8_6
redhat rhel tus < 0:4.18.0-477.143.1.el8_8 0:4.18.0-477.143.1.el8_8
redhat rhel e4s < 0:4.18.0-477.143.1.el8_8 0:4.18.0-477.143.1.el8_8
redhat rhel e4s = 8.8 No fix listed
redhat enterprise linux < 0:5.14.0-687.10.1.el9_8 0:5.14.0-687.10.1.el9_8
redhat rhel e4s < 0:5.14.0-70.180.1.el9_0 0:5.14.0-70.180.1.el9_0
redhat rhel e4s < 0:5.14.0-70.180.1.rt21.252.el9_0 0:5.14.0-70.180.1.rt21.252.el9_0
redhat rhel e4s < 0:5.14.0-284.172.1.el9_2 0:5.14.0-284.172.1.el9_2
redhat rhel e4s < 0:5.14.0-284.172.1.rt14.457.el9_2 0:5.14.0-284.172.1.rt14.457.el9_2
redhat rhel e4s = 9.2 No fix listed
redhat rhel eus < 0:5.14.0-427.126.1.el9_4 0:5.14.0-427.126.1.el9_4
redhat rhel e4s = 9.4 No fix listed
redhat rhel eus < 0:5.14.0-570.116.1.el9_6 0:5.14.0-570.116.1.el9_6
redhat rhel eus = 9.6 No fix listed
redhat openshift < 412.86.202605271418-0 412.86.202605271418-0
redhat openshift < 413.92.202605271328-0 413.92.202605271328-0
redhat openshift < 414.92.202606231112-0 414.92.202606231112-0
redhat openshift < 415.92.202606030318-0 415.92.202606030318-0
redhat openshift < 416.94.202605200242-0 416.94.202605200242-0
redhat openshift < 416.94.202606051757-0 416.94.202606051757-0
redhat openshift < 417.94.202606250942-0 417.94.202606250942-0
redhat openshift < 418.94.202605260517-0 418.94.202605260517-0
redhat openshift < 4.19.9.6.202606031700-0 4.19.9.6.202606031700-0
redhat openshift < 4.20.9.6.202605270908-0 4.20.9.6.202605270908-0
redhat openshift < 0:5.14.0-570.116.1.el9_6 0:5.14.0-570.116.1.el9_6
redhat openshift < 0:4.21.0-202605142021.p2.geab2218.assembly.stream.el10 0:4.21.0-202605142021.p2.geab2218.assembly.stream.el10
redhat openshift < 4.21.9.6.202606030721-0 4.21.9.6.202606030721-0
redhat enterprise linux = 6 No fix listed
redhat enterprise linux = 7 No fix listed
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP >= V3.1.6, < V3.1.7 V3.1.7
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP >= V3.1.5 No fix listed
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP >= V3.1.6, < V3.1.7 V3.1.7
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP >= V3.1.5 No fix listed
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP >= V3.1.6, < V3.1.7 V3.1.7
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP >= V3.1.5 No fix listed
redhat/kernel(Red Hat:enterprise_linux_nvidia:10::el10) < 6.12.0-211.8.el10nv 6.12.0-211.8.el10nv
redhat/kernel(Red Hat:enterprise_linux_nvidia:10::el10) < 6.12.0-231.12.el10nv 6.12.0-231.12.el10nv
redhat/kernel(Red Hat:enterprise_linux:10.2) < 6.12.0-211.16.1.el10_2 6.12.0-211.16.1.el10_2
redhat/kernel(Red Hat:enterprise_linux_eus:10.0) < 6.12.0-55.75.1.el10_0 6.12.0-55.75.1.el10_0
redhat/kernel-rt(Red Hat:enterprise_linux:8::nfv) < 4.18.0-553.125.1.rt7.466.el8_10 4.18.0-553.125.1.rt7.466.el8_10
redhat/kernel(Red Hat:enterprise_linux:8) < 4.18.0-553.125.1.el8_10 4.18.0-553.125.1.el8_10
redhat/kpatch-patch(Red Hat:enterprise_linux:8) All versions No fix listed
redhat/kernel(Red Hat:rhel_aus:8.4) < 4.18.0-305.192.1.el8_4 4.18.0-305.192.1.el8_4
redhat/kernel(Red Hat:rhel_eus_long_life:8.4) < 4.18.0-305.192.1.el8_4 4.18.0-305.192.1.el8_4
redhat/kernel(Red Hat:rhel_aus:8.6) < 4.18.0-372.193.1.el8_6 4.18.0-372.193.1.el8_6
redhat/kernel(Red Hat:rhel_tus:8.6) < 4.18.0-372.193.1.el8_6 4.18.0-372.193.1.el8_6
redhat/kernel(Red Hat:rhel_e4s:8.6) < 4.18.0-372.193.1.el8_6 4.18.0-372.193.1.el8_6
redhat/kernel(Red Hat:rhel_tus:8.8) < 4.18.0-477.143.1.el8_8 4.18.0-477.143.1.el8_8
redhat/kernel(Red Hat:rhel_e4s:8.8) < 4.18.0-477.143.1.el8_8 4.18.0-477.143.1.el8_8
redhat/kpatch-patch(Red Hat:rhel_e4s:8.8) All versions No fix listed
redhat/kernel(Red Hat:enterprise_linux:9) < 5.14.0-687.10.1.el9_8 5.14.0-687.10.1.el9_8
redhat/kernel(Red Hat:rhel_e4s:9.0) < 5.14.0-70.180.1.el9_0 5.14.0-70.180.1.el9_0
redhat/kernel-rt(Red Hat:rhel_e4s:9.0::nfv) < 5.14.0-70.180.1.rt21.252.el9_0 5.14.0-70.180.1.rt21.252.el9_0
redhat/kernel(Red Hat:rhel_e4s:9.2) < 5.14.0-284.172.1.el9_2 5.14.0-284.172.1.el9_2
redhat/kernel-rt(Red Hat:rhel_e4s:9.2::nfv) < 5.14.0-284.172.1.rt14.457.el9_2 5.14.0-284.172.1.rt14.457.el9_2
redhat/kpatch-patch(Red Hat:rhel_e4s:9.2) All versions No fix listed
redhat/kernel(Red Hat:rhel_eus:9.4) < 5.14.0-427.126.1.el9_4 5.14.0-427.126.1.el9_4
redhat/kpatch-patch(Red Hat:rhel_e4s:9.4) All versions No fix listed
redhat/kernel(Red Hat:rhel_eus:9.6) < 5.14.0-570.116.1.el9_6 5.14.0-570.116.1.el9_6
redhat/kpatch-patch(Red Hat:rhel_eus:9.6) All versions No fix listed
redhat/openshift/ose-rhel-coreos(Red Hat:openshift:4.12::el8) < 8:412.86.202605271418-0 8:412.86.202605271418-0
redhat/openshift/ose-rhel-coreos(Red Hat:openshift:4.13::el9) < 9:413.92.202605271328-0 9:413.92.202605271328-0
redhat/openshift/ose-rhel-coreos(Red Hat:openshift:4.14::el9) < 9:414.92.202606231112-0 9:414.92.202606231112-0
redhat/openshift/ose-rhel-coreos(Red Hat:openshift:4.15::el9) < 9:415.92.202606030318-0 9:415.92.202606030318-0
redhat/openshift/ose-rhel-coreos(Red Hat:openshift:4.16::el9) < 9:416.94.202605200242-0 9:416.94.202605200242-0
redhat/openshift/ose-rhel-coreos(Red Hat:openshift:4.16::el9) < 9:416.94.202606051757-0 9:416.94.202606051757-0
redhat/openshift/ose-rhel-coreos(Red Hat:openshift:4.17::el9) < 9:417.94.202606250942-0 9:417.94.202606250942-0
redhat/openshift/ose-rhel-coreos(Red Hat:openshift:4.18::el9) < 9:418.94.202605260517-0 9:418.94.202605260517-0
redhat/openshift/ose-rhel-coreos(Red Hat:openshift:4.19::el9) < 9:4.19.9.6.202606031700-0 9:4.19.9.6.202606031700-0
redhat/openshift/ose-rhel-coreos(Red Hat:openshift:4.20::el9) < 9:4.20.9.6.202605270908-0 9:4.20.9.6.202605270908-0
redhat/kernel(Red Hat:openshift:4.21::el8) < 5.14.0-570.116.1.el9_6 5.14.0-570.116.1.el9_6
redhat openshift(Red Hat:openshift:4.21::el8) < 4.21.0-202605142021.p2.geab2218.assembly.stream.el10 4.21.0-202605142021.p2.geab2218.assembly.stream.el10
redhat/kernel(Red Hat:openshift:4.21::el9) < 5.14.0-570.116.1.el9_6 5.14.0-570.116.1.el9_6
redhat openshift(Red Hat:openshift:4.21::el9) < 4.21.0-202605142021.p2.geab2218.assembly.stream.el10 4.21.0-202605142021.p2.geab2218.assembly.stream.el10
redhat/openshift/ose-rhel-coreos(Red Hat:openshift:4.21::el9) < 9:4.21.9.6.202606030721-0 9:4.21.9.6.202606030721-0
debian/linux(Debian:12) < 6.1.174-1 6.1.174-1
debian/linux(Debian:12) = 6.1.106-1 No fix listed
debian/linux(Debian:12) = 6.1.106-2 No fix listed
debian/linux(Debian:12) = 6.1.106-3 No fix listed
debian/linux(Debian:12) = 6.1.112-1 No fix listed
debian/linux(Debian:12) = 6.1.115-1 No fix listed
debian/linux(Debian:12) = 6.1.119-1 No fix listed
debian/linux(Debian:12) = 6.1.123-1 No fix listed
debian/linux(Debian:12) = 6.1.124-1 No fix listed
debian/linux(Debian:12) = 6.1.128-1 No fix listed
debian/linux(Debian:12) = 6.1.129-1 No fix listed
debian/linux(Debian:12) = 6.1.133-1 No fix listed
debian/linux(Debian:12) = 6.1.135-1 No fix listed
debian/linux(Debian:12) = 6.1.137-1 No fix listed
debian/linux(Debian:12) = 6.1.139-1 No fix listed
debian/linux(Debian:12) = 6.1.140-1 No fix listed
debian/linux(Debian:12) = 6.1.147-1 No fix listed
debian/linux(Debian:12) = 6.1.148-1 No fix listed
debian/linux(Debian:12) = 6.1.153-1 No fix listed
debian/linux(Debian:12) = 6.1.158-1 No fix listed
debian/linux(Debian:12) = 6.1.159-1 No fix listed
debian/linux(Debian:12) = 6.1.162-1 No fix listed
debian/linux(Debian:12) = 6.1.164-1 No fix listed
debian/linux(Debian:12) = 6.1.170-1 No fix listed
debian/linux(Debian:12) = 6.1.170-2 No fix listed
debian/linux(Debian:12) = 6.1.170-3 No fix listed
debian/linux(Debian:12) = 6.1.172-1 No fix listed
debian/linux(Debian:12) = 6.1.27-1 No fix listed
debian/linux(Debian:12) = 6.1.37-1 No fix listed
debian/linux(Debian:12) = 6.1.38-1 No fix listed
debian/linux(Debian:12) = 6.1.38-2 No fix listed
debian/linux(Debian:12) = 6.1.38-2~bpo11+1 No fix listed
debian/linux(Debian:12) = 6.1.38-3 No fix listed
debian/linux(Debian:12) = 6.1.38-4 No fix listed
debian/linux(Debian:12) = 6.1.38-4~bpo11+1 No fix listed
debian/linux(Debian:12) = 6.1.52-1 No fix listed
debian/linux(Debian:12) = 6.1.55-1 No fix listed
debian/linux(Debian:12) = 6.1.55-1~bpo11+1 No fix listed
debian/linux(Debian:12) = 6.1.64-1 No fix listed
debian/linux(Debian:12) = 6.1.66-1 No fix listed
debian/linux(Debian:12) = 6.1.67-1 No fix listed
debian/linux(Debian:12) = 6.1.69-1 No fix listed
debian/linux(Debian:12) = 6.1.69-1~bpo11+1 No fix listed
debian/linux(Debian:12) = 6.1.76-1 No fix listed
debian/linux(Debian:12) = 6.1.76-1~bpo11+1 No fix listed
debian/linux(Debian:12) = 6.1.82-1 No fix listed
debian/linux(Debian:12) = 6.1.85-1 No fix listed
debian/linux(Debian:12) = 6.1.90-1 No fix listed
debian/linux(Debian:12) = 6.1.90-1~bpo11+1 No fix listed
debian/linux(Debian:12) = 6.1.94-1 No fix listed
debian/linux(Debian:12) = 6.1.94-1~bpo11+1 No fix listed
debian/linux(Debian:12) = 6.1.98-1 No fix listed
debian/linux(Debian:12) = 6.1.99-1 No fix listed
debian/linux(Debian:13) < 6.12.90-1 6.12.90-1
debian/linux(Debian:13) = 6.12.38-1 No fix listed
debian/linux(Debian:13) = 6.12.41-1 No fix listed
debian/linux(Debian:13) = 6.12.43-1 No fix listed
debian/linux(Debian:13) = 6.12.43-1~bpo12+1 No fix listed
debian/linux(Debian:13) = 6.12.48-1 No fix listed
debian/linux(Debian:13) = 6.12.57-1 No fix listed
debian/linux(Debian:13) = 6.12.57-1~bpo12+1 No fix listed
debian/linux(Debian:13) = 6.12.63-1 No fix listed
debian/linux(Debian:13) = 6.12.63-1~bpo12+1 No fix listed
debian/linux(Debian:13) = 6.12.69-1 No fix listed
debian/linux(Debian:13) = 6.12.69-1~bpo12+1 No fix listed
debian/linux(Debian:13) = 6.12.73-1 No fix listed
debian/linux(Debian:13) = 6.12.73-1~bpo12+1 No fix listed
debian/linux(Debian:13) = 6.12.74-1 No fix listed
debian/linux(Debian:13) = 6.12.74-2 No fix listed
debian/linux(Debian:13) = 6.12.74-2~bpo12+1 No fix listed
debian/linux(Debian:13) = 6.12.85-1 No fix listed
debian/linux(Debian:13) = 6.12.85-1~bpo12+1 No fix listed
debian/linux(Debian:13) = 6.12.86-1 No fix listed
debian/linux(Debian:13) = 6.12.86-1~bpo12+1 No fix listed
debian/linux(Debian:13) = 6.12.88-1 No fix listed
debian/linux(Debian:13) = 6.12.88-1~bpo12+1 No fix listed
debian/linux(Debian:13) = 6.12.90-1~bpo12+1 No fix listed
debian/linux(Debian:14) < 7.0.9-1 7.0.9-1
debian/linux(Debian:14) = 6.12.100-1 No fix listed
debian/linux(Debian:14) = 6.12.101-1 No fix listed
debian/linux(Debian:14) = 6.12.105-1 No fix listed
debian/linux(Debian:14) = 6.12.107-1 No fix listed
debian/linux(Debian:14) = 6.12.111-1 No fix listed
debian/linux(Debian:14) = 6.12.113-1 No fix listed
debian/linux(Debian:14) = 6.12.38-1 No fix listed
debian/linux(Debian:14) = 6.12.41-1 No fix listed
debian/linux(Debian:14) = 6.12.43-1 No fix listed
debian/linux(Debian:14) = 6.12.43-1~bpo12+1 No fix listed
debian/linux(Debian:14) = 6.12.48-1 No fix listed
debian/linux(Debian:14) = 6.12.57-1 No fix listed
debian/linux(Debian:14) = 6.12.57-1~bpo12+1 No fix listed
debian/linux(Debian:14) = 6.12.63-1 No fix listed
debian/linux(Debian:14) = 6.12.63-1~bpo12+1 No fix listed
debian/linux(Debian:14) = 6.12.69-1 No fix listed
debian/linux(Debian:14) = 6.12.69-1~bpo12+1 No fix listed
debian/linux(Debian:14) = 6.12.73-1 No fix listed
debian/linux(Debian:14) = 6.12.73-1~bpo12+1 No fix listed

References