Skip to content
securitytabs

CVE-2026-46300

High7.8CISA KEV — exploited in the wild

Linux: net: skbuff: preserve shared-frag marker during coalescingtitle from the CVE record

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.

CVSS
7.8v3.1
EPSS (exploit probability)
10.2%96th pct
CISA KEV
Listed

EPSS trendFIRST daily scores, last 90 days

FIRST EPSS rose from 2.4% on 2026-09-27 to 10.2% on 2026-10-28, ranging 2.4%–10.2% across 31 daily scores.
2026-09-27 → 2026-10-28 · 31 days · 2.4%–10.2%
Daily values
FIRST EPSS daily scores for this CVE
Score dateEPSSPercentile
2026-10-2810.2%95.7%
2026-10-2710.2%95.6%
2026-10-2610.2%95.6%
2026-10-2510.2%95.6%
2026-10-242.4%84.1%
2026-10-232.4%84.1%
2026-10-222.4%84.1%
2026-10-212.4%84.1%
2026-10-202.4%84.0%
2026-10-192.4%84.0%
2026-10-182.4%83.9%
2026-10-172.4%83.9%
2026-10-162.4%83.9%
2026-10-152.4%83.9%
2026-10-142.4%83.9%
2026-10-132.4%83.8%
2026-10-122.4%83.8%
2026-10-112.4%83.8%
2026-10-102.4%83.7%
2026-10-092.4%83.7%
2026-10-082.4%83.7%
2026-10-072.4%83.7%
2026-10-062.4%83.7%
2026-10-052.4%83.6%
2026-10-042.4%83.6%
2026-10-032.4%83.6%
2026-10-022.4%83.6%
2026-10-012.4%83.6%
2026-09-302.4%83.6%
2026-09-292.4%83.6%
2026-09-272.4%83.6%

CISA KEV entrycatalogue 2026.10.28

Date added
2026-10-28
Federal due date
2026-10-31
Known ransomware use
Unknown

Required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Verbatim from the CISA KEV catalogue (CISA KEV, fetched 2026-10-28 22:23 UTC). The due date applies to US federal agencies under BOD 22-01.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • linux linux kernel

Coverage1 article

References

Facts sourced from NVD, FIRST EPSS, and CISA KEV. Last synced 2026-10-28 22:23 UTC.

  • CVSS & description: NVD 2.0, fetched 2026-10-28 20:23 UTC
  • EPSS: FIRST EPSS, fetched 2026-10-28 22:23 UTC; score date 2026-10-28
  • KEV: CISA KEV, fetched 2026-10-28 22:23 UTC