{"schema":"threatline.record/2","record":{"id":"CVE-2026-46300","aliases":[],"summary":"net: skbuff: preserve shared-frag marker during coalescing","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: preserve shared-frag marker during coalescing\n\nskb_try_coalesce() can attach paged frags from @from to @to.  If @from\nhas SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same\nexternally-owned or page-cache-backed frags, but the shared-frag marker\nis currently lost.\n\nThat breaks the invariant relied on by later in-place writers.  In\nparticular, ESP input checks skb_has_shared_frag() before deciding\nwhether an uncloned nonlinear skb can skip skb_cow_data().  If TCP\nreceive coalescing has moved shared frags into an unmarked skb, ESP can\nsee skb_has_shared_frag() as false and decrypt in place over page-cache\nbacked frags.\n\nPropagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged\nfrags.  The tailroom copy path does not need the marker because it copies\nbytes into @to's linear data rather than transferring frag descriptors.","categories":["Operating systems"],"product":"Linux","vendor":"Linux","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46300","source_modified_at":"2026-10-28T19:59:23.147Z","fetched_at":"2026-10-28T20:58:01.013507Z","product":"Linux","vendor":"Linux","versions":[{"version":"cef401de7be8c4e155c6746bfccf721a4fa5fab9","lessThan":"3599e6b3cc1ada96883d496a50a210d3afbb6987","status":"affected","versionType":"git"},{"version":"cef401de7be8c4e155c6746bfccf721a4fa5fab9","lessThan":"2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c","status":"affected","versionType":"git"},{"version":"cef401de7be8c4e155c6746bfccf721a4fa5fab9","lessThan":"9d3e5fd19fe1063bf607219e8562fbd567b8e8d5","status":"affected","versionType":"git"},{"version":"cef401de7be8c4e155c6746bfccf721a4fa5fab9","lessThan":"78bf6b6bb19541d19fbda6242e7cfe2c682763c0","status":"affected","versionType":"git"},{"version":"cef401de7be8c4e155c6746bfccf721a4fa5fab9","lessThan":"760e1addc27ba1a7beb4a0a7e8b3e9ec49e7a34e","status":"affected","versionType":"git"},{"version":"cef401de7be8c4e155c6746bfccf721a4fa5fab9","lessThan":"3bd9e113d50034db99d7ef69fd8e5242d15e414a","status":"affected","versionType":"git"},{"version":"cef401de7be8c4e155c6746bfccf721a4fa5fab9","lessThan":"3884358a9286b17f389a72b1426fc4547c23c111","status":"affected","versionType":"git"},{"version":"cef401de7be8c4e155c6746bfccf721a4fa5fab9","lessThan":"f84eca5817390257cef78013d0112481c503b4a3","status":"affected","versionType":"git"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46300","source_modified_at":"2026-10-28T19:59:23.147Z","fetched_at":"2026-10-28T20:58:01.013507Z","product":"Linux","vendor":"Linux","versions":[{"version":"3.9","status":"affected"},{"version":"0","lessThan":"3.9","status":"unaffected","versionType":"semver"},{"version":"5.10.257","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.208","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.174","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.141","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.91","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.33","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.0.10","lessThanOrEqual":"7.0.*","status":"unaffected","versionType":"semver"},{"version":"7.1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46300","source_modified_at":"2026-10-28T19:59:23.147Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"Linux","ecosystem":null},"version":"3599e6b3cc1ada96883d496a50a210d3afbb6987","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46300","source_modified_at":"2026-10-28T19:59:23.147Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"Linux","ecosystem":null},"version":"2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46300","source_modified_at":"2026-10-28T19:59:23.147Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"Linux","ecosystem":null},"version":"9d3e5fd19fe1063bf607219e8562fbd567b8e8d5","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46300","source_modified_at":"2026-10-28T19:59:23.147Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"Linux","ecosystem":null},"version":"78bf6b6bb19541d19fbda6242e7cfe2c682763c0","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46300","source_modified_at":"2026-10-28T19:59:23.147Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"Linux","ecosystem":null},"version":"760e1addc27ba1a7beb4a0a7e8b3e9ec49e7a34e","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46300","source_modified_at":"2026-10-28T19:59:23.147Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"Linux","ecosystem":null},"version":"3bd9e113d50034db99d7ef69fd8e5242d15e414a","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46300","source_modified_at":"2026-10-28T19:59:23.147Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"Linux","ecosystem":null},"version":"3884358a9286b17f389a72b1426fc4547c23c111","basis":"first unaffected version stated in the CVE record"}],"cvss":7.8,"severity":"High","kev":{"listed":false},"epss":{"probability":0.10192,"percentile":0.95651,"score_date":"2026-10-28"},"published_at":"2026-05-23T11:44:02.231Z","modified_at":"2026-10-28T19:59:23.147Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-46300","fetched_at":"2026-10-28T20:58:01.013507Z","source_modified_at":"2026-10-28T19:59:23.147Z"},{"source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/cve_2026_46300_fragnesia.rb","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-05-14"},{"source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/52591","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-05-29"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-46300","fetched_at":"2026-10-28T20:58:01.013507Z","source_modified_at":"2026-10-28"}],"sources":["CVE List","Metasploit","Exploit-DB","EPSS"],"references":[{"source":"CVE List","url":"https://git.kernel.org/stable/c/3599e6b3cc1ada96883d496a50a210d3afbb6987"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/9d3e5fd19fe1063bf607219e8562fbd567b8e8d5"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/78bf6b6bb19541d19fbda6242e7cfe2c682763c0"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/760e1addc27ba1a7beb4a0a7e8b3e9ec49e7a34e"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/3bd9e113d50034db99d7ef69fd8e5242d15e414a"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/3884358a9286b17f389a72b1426fc4547c23c111"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/f84eca5817390257cef78013d0112481c503b4a3"},{"source":"CVE List","url":"https://access.redhat.com/security/cve/CVE-2026-46300","tags":["vdb-entry","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477015","tags":["issue-tracking","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46300.json","tags":["x_sadp-csaf-vex"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:19540","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:33486","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHBA-2026:20032","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:21695","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:21690","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:28887","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:23233","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:20087","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:25044","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:34098","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:21656","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:23245","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:21702","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:23240","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:20299","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:19569","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:19705","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:20593","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:20054","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:20129","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:19568","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:19666","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:23470","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:20130","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:20051","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:19521","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:23471","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:23469","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:24814","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:23468","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:19664","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:19711","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:19875","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"CVE List","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"CVE List","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-46300","tags":["government-resource"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"active","automatable":"no","technical_impact":"total","assessed_at":"2026-10-28T19:50:15.868416Z"},"exploits":[{"added":"2026-07-28","check":true,"date":"2026-05-14","kind":"Exploit module","name":"Fragnesia LPE (CVE-2026-46300)","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/cve_2026_46300_fragnesia.rb"},{"added":"2026-05-29","date":"2026-05-29","kind":"Local exploit","name":"Linux Kernel -  Local Privilege Escalation","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/52591","verified":false}],"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-28T19:59:23.147Z","content_hash":"c512137f9b206b10e1864114b1315d84a1154cedd4593075b665de9c83c7a63c"}}