IT SBIT Services
Schneeberger
DEEN
CVE tracker

Linux Kernel: Shared-frag marker lost during socket buffer coalescing

CVE-2026-46300High 7.8Actively exploitedPublic exploit

← All vulnerabilities

Actively exploited – in the CISA catalogue of Known Exploited Vulnerabilities since 28 Oct 2026
Deadline for US federal agencies: 31 Oct 2026

Summary

The Linux kernel does not preserve the shared-fragment marker when socket buffers are coalesced in skb_try_coalesce(). ESP input processing then skips copy-on-write for these buffers and may decrypt in place over page-cache-backed fragments. A local attacker with low privileges can exploit this to modify data they should not be able to change, and research notes describe it as a privilege escalation path. CISA lists the flaw as known exploited.

Affected

  • Linux kernel from commit cef401de7be8 (3.9 and later) until the fixed stable releases listed below, per the CNA record
  • Mainline 7.1 release candidates: inconsistent across sources, verify with your vendor

Fixed in

  • Stable releases 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33 and 7.0.10, and later
  • Red Hat Enterprise Linux: kernel errata RHSA-2026:19568 (RHEL 9), RHSA-2026:19569 (RHEL 10), RHSA-2026:19666 (RHEL 8)
  • Other distributions: per-release patches, check your vendor advisories

Workaround

Unknown.

Exploitation

  • CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-10-28
  • CISA SSVC: exploitation active, not automatable, total technical impact

Our recommendation

  • Update the Linux kernel to a fixed version from your distribution or the stable branch
  • Reboot after patching or install the available livepatch
  • Identify systems with local user access or shared hosts and prioritise them
  • Monitor for unexpected modifications of files and for privilege escalation attempts

Public exploits

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 13:44.

Original description (NVD)

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.

Required action (CISA)

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

NVD references (40)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed