Linux kernel: skb sharedfrag flag mispropagated in fragtransfer helpers
CVE-2026-46300 Published on May 23, 2026

net: skbuff: preserve shared-frag marker during coalescing
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.

NVD

Vulnerability Analysis

CVE-2026-46300 is exploitable with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:

LOCAL

Attack Complexity:

LOW

Privileges Required:

LOW

User Interaction:

NONE

Scope:

UNCHANGED

Confidentiality Impact:

HIGH

Integrity Impact:

HIGH

Availability Impact:

HIGH

Weakness Type

Write-what-where Condition

Any condition where the attacker has the ability to write an arbitrary value to an arbitrary location, often as the result of a buffer overflow.

Products Associated with CVE-2026-46300

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-46300 are published in these products:

Amazon Aws

Linux Kernel

Canonical Ubuntu Linux

Red Hat Enterprise Linux Nvidia

Red Hat Openshift

Red Hat Enterprise Linux Eus

Red Hat Enterprise Linux (RHEL)

Red Hat Rhel E4s

Red Hat Rhel Eus

Red Hat Rhel Aus

Red Hat Rhel Eus Long Life

Red Hat Rhel Tus

Affected Versions

Linux:

Version cef401de7be8c4e155c6746bfccf721a4fa5fab9 and below 3599e6b3cc1ada96883d496a50a210d3afbb6987 is affected.
Version cef401de7be8c4e155c6746bfccf721a4fa5fab9 and below 2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c is affected.
Version cef401de7be8c4e155c6746bfccf721a4fa5fab9 and below 9d3e5fd19fe1063bf607219e8562fbd567b8e8d5 is affected.
Version cef401de7be8c4e155c6746bfccf721a4fa5fab9 and below 78bf6b6bb19541d19fbda6242e7cfe2c682763c0 is affected.
Version cef401de7be8c4e155c6746bfccf721a4fa5fab9 and below 760e1addc27ba1a7beb4a0a7e8b3e9ec49e7a34e is affected.
Version cef401de7be8c4e155c6746bfccf721a4fa5fab9 and below 3bd9e113d50034db99d7ef69fd8e5242d15e414a is affected.
Version cef401de7be8c4e155c6746bfccf721a4fa5fab9 and below 3884358a9286b17f389a72b1426fc4547c23c111 is affected.
Version cef401de7be8c4e155c6746bfccf721a4fa5fab9 and below f84eca5817390257cef78013d0112481c503b4a3 is affected.

Linux:

Version 3.9 is affected.
Before 3.9 is unaffected.
Version 5.10.257, <= 5.10.* is unaffected.
Version 5.15.208, <= 5.15.* is unaffected.
Version 6.1.174, <= 6.1.* is unaffected.
Version 6.6.141, <= 6.6.* is unaffected.
Version 6.12.91, <= 6.12.* is unaffected.
Version 6.18.33, <= 6.18.* is unaffected.
Version 7.0.10, <= 7.0.* is unaffected.
Version 7.1, <= * is unaffected.

Red Hat NVIDIA for RHEL 10:

Version 0:6.12.0-211.8.el10nv and below * is unaffected.
Version 0:6.12.0-231.12.el10nv and below * is unaffected.

Red Hat Enterprise Linux 10:

Version 0:6.12.0-211.16.1.el10_2 and below * is unaffected.

Red Hat Enterprise Linux 10.0 Extended Update Support:

Version 0:6.12.0-55.75.1.el10_0 and below * is unaffected.

Red Hat Enterprise Linux 8:

Version 0:4.18.0-553.125.1.rt7.466.el8_10 and below * is unaffected.

Red Hat Enterprise Linux 8:

Version 0:4.18.0-553.125.1.el8_10 and below * is unaffected.

Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support:

Version 0:4.18.0-305.192.1.el8_4 and below * is unaffected.

Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On:

Version 0:4.18.0-305.192.1.el8_4 and below * is unaffected.

Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support:

Version 0:4.18.0-372.193.1.el8_6 and below * is unaffected.

Red Hat Enterprise Linux 8.6 Telecommunications Update Service:

Version 0:4.18.0-372.193.1.el8_6 and below * is unaffected.

Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions:

Version 0:4.18.0-372.193.1.el8_6 and below * is unaffected.

Red Hat Enterprise Linux 8.8 Telecommunications Update Service:

Version 0:4.18.0-477.143.1.el8_8 and below * is unaffected.

Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions:

Version 0:4.18.0-477.143.1.el8_8 and below * is unaffected.

Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions: Red Hat Enterprise Linux 9:

Version 0:5.14.0-687.10.1.el9_8 and below * is unaffected.

Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions:

Version 0:5.14.0-70.180.1.el9_0 and below * is unaffected.

Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions:

Version 0:5.14.0-70.180.1.rt21.252.el9_0 and below * is unaffected.

Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions:

Version 0:5.14.0-284.172.1.el9_2 and below * is unaffected.

Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions:

Version 0:5.14.0-284.172.1.rt14.457.el9_2 and below * is unaffected.

Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions: Red Hat Enterprise Linux 9.4 Extended Update Support:

Version 0:5.14.0-427.126.1.el9_4 and below * is unaffected.

Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions: Red Hat Enterprise Linux 9.6 Extended Update Support:

Version 0:5.14.0-570.116.1.el9_6 and below * is unaffected.

Red Hat Enterprise Linux 9.6 Extended Update Support: Red Hat OpenShift Container Platform 4.12:

Version 412.86.202605271418-0 and below * is unaffected.

Red Hat OpenShift Container Platform 4.13:

Version 413.92.202605271328-0 and below * is unaffected.

Red Hat OpenShift Container Platform 4.14:

Version 414.92.202606231112-0 and below * is unaffected.

Red Hat OpenShift Container Platform 4.15:

Version 415.92.202606030318-0 and below * is unaffected.

Red Hat OpenShift Container Platform 4.16:

Version 416.94.202605200242-0 and below * is unaffected.
Version 416.94.202606051757-0 and below * is unaffected.

Red Hat OpenShift Container Platform 4.17:

Version 417.94.202606250942-0 and below * is unaffected.

Red Hat OpenShift Container Platform 4.18:

Version 418.94.202605260517-0 and below * is unaffected.

Red Hat OpenShift Container Platform 4.19:

Version 4.19.9.6.202606031700-0 and below * is unaffected.

Red Hat OpenShift Container Platform 4.20:

Version 4.20.9.6.202605270908-0 and below * is unaffected.

Red Hat OpenShift Container Platform 4.21:

Version 0:5.14.0-570.116.1.el9_6 and below * is unaffected.

Red Hat OpenShift Container Platform 4.21:

Version 0:4.21.0-202605142021.p2.geab2218.assembly.stream.el10 and below * is unaffected.

Red Hat OpenShift Container Platform 4.21:

Version 4.21.9.6.202606030721-0 and below * is unaffected.

Red Hat Enterprise Linux 6: Red Hat Enterprise Linux 7: Red Hat Enterprise Linux 7: Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP:

Version V3.1.6 and below * is affected.

Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP:

Version V3.1.5 and below * is affected.

Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP:

Version V3.1.6 and below * is affected.

Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP:

Version V3.1.5 and below * is affected.

Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP:

Version V3.1.6 and below * is affected.

Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP:

Version V3.1.5 and below * is affected.

Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP:

Version V3.1.6 and below * is affected.

Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP:

Version V3.1.5 and below * is affected.

Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP:

Version V3.1.6 and below * is affected.

Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP:

Version V3.1.5 and below * is affected.

Exploit Probability

EPSS

2.50%

Percentile

83.01%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.

Linux kernel: skb sharedfrag flag mispropagated in fragtransfer helpersCVE-2026-46300 Published on May 23, 2026

Vulnerability Analysis

Weakness Type

Write-what-where Condition

Products Associated with CVE-2026-46300

Affected Versions

Exploit Probability

Linux kernel: skb sharedfrag flag mispropagated in fragtransfer helpers
CVE-2026-46300 Published on May 23, 2026