CVEs / CVE-2026-46300

CVE-2026-46300: Linux Kernel Missing Initialization of a Variable Vulnerability

Known exploited in the CISA KEV catalog since 28 Oct 2026
high 7.8 CVSS 3.1 (NVD)
EPSS 16.1% chance of exploitation in the next 30 days, higher than 96% of CVEs (30 Oct 2026)
Last changed at its sources 31 Oct 2026

Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.

Check your servers with Stackurity Already using Stackurity? Search for CVE-2026-46300

Summary

Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.
CISA, Known Exploited Vulnerabilities catalog

Description

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.
The CVE record, via NVD · published 23 May 2026 · NVD status: Analyzed

Affected and fixed versions

As stated by the CVE record (from the CNA)
Product	Affected	Fixed in
Linux Linux	from cef401de7be8c4e155c6746bfccf721a4fa5fab9, before 3599e6b3cc1ada96883d496a50a210d3afbb6987	3599e6b3cc1ada96883d496a50a210d3afbb6987
Linux Linux	from cef401de7be8c4e155c6746bfccf721a4fa5fab9, before 2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c	2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c
Linux Linux	from cef401de7be8c4e155c6746bfccf721a4fa5fab9, before 9d3e5fd19fe1063bf607219e8562fbd567b8e8d5	9d3e5fd19fe1063bf607219e8562fbd567b8e8d5
Linux Linux	from cef401de7be8c4e155c6746bfccf721a4fa5fab9, before 78bf6b6bb19541d19fbda6242e7cfe2c682763c0	78bf6b6bb19541d19fbda6242e7cfe2c682763c0
Linux Linux	from cef401de7be8c4e155c6746bfccf721a4fa5fab9, before 760e1addc27ba1a7beb4a0a7e8b3e9ec49e7a34e	760e1addc27ba1a7beb4a0a7e8b3e9ec49e7a34e
Linux Linux	from cef401de7be8c4e155c6746bfccf721a4fa5fab9, before 3bd9e113d50034db99d7ef69fd8e5242d15e414a	3bd9e113d50034db99d7ef69fd8e5242d15e414a
Linux Linux	from cef401de7be8c4e155c6746bfccf721a4fa5fab9, before 3884358a9286b17f389a72b1426fc4547c23c111	3884358a9286b17f389a72b1426fc4547c23c111
Linux Linux	from cef401de7be8c4e155c6746bfccf721a4fa5fab9, before f84eca5817390257cef78013d0112481c503b4a3	f84eca5817390257cef78013d0112481c503b4a3
Linux Linux	3.9	—
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	from V3.1.6, before V3.1.7	V3.1.7
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	from V3.1.5 onwards	—
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	from V3.1.6, before V3.1.7	V3.1.7
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	from V3.1.5 onwards	—
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	from V3.1.6, before V3.1.7	V3.1.7
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	from V3.1.5 onwards	—

As stated by OSV
Product	Affected	Fixed in
Kernel (Linux)	from 3.9.0, before 5.10.257	5.10.257
Kernel (Linux)	from 5.11.0, before 5.15.208	5.15.208
Kernel (Linux)	from 5.16.0, before 6.1.174	6.1.174
Kernel (Linux)	from 6.2.0, before 6.6.141	6.6.141
Kernel (Linux)	from 6.7.0, before 6.12.91	6.12.91
Kernel (Linux)	from 6.13.0, before 6.18.33	6.18.33
Kernel (Linux)	from 6.19.0, before 7.0.10	7.0.10

Exploitation

In CISA KEV since	28 Oct 2026
Due date for US federal agencies	31 Oct 2026
Used in ransomware campaigns	Unknown
Required action	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Severity

CVSS 3.1	7.8 high `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H` Scored by NVD
Weakness	CWE-787, CWE-456, CWE-123

On the Stackurity blog

Linux kernel flaw CVE-2026-46300 joins CISA's exploited list 29 Oct 2026

References

CVE-2026-46300 on NVD
CVE-2026-46300 in the CISA KEV catalog
https://git.kernel.org/stable/c/3599e6b3cc1ada96883d496a50a210d3afbb6987 (cited by CISA)
https://git.kernel.org/stable/c/2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c (cited by CISA)
https://git.kernel.org/stable/c/9d3e5fd19fe1063bf607219e8562fbd567b8e8d5 (cited by CISA)
https://git.kernel.org/stable/c/78bf6b6bb19541d19fbda6242e7cfe2c682763c0 (cited by CISA)
https://git.kernel.org/stable/c/760e1addc27ba1a7beb4a0a7e8b3e9ec49e7a34e (cited by CISA)
https://git.kernel.org/stable/c/3bd9e113d50034db99d7ef69fd8e5242d15e414a (cited by CISA)
https://git.kernel.org/stable/c/3884358a9286b17f389a72b1426fc4547c23c111 (cited by CISA)
https://git.kernel.org/stable/c/f84eca5817390257cef78013d0112481c503b4a3 (cited by CISA)
https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk (cited by CISA)
https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk (cited by CISA)
CVE-2026-46300 on OSV
https://git.kernel.org/stable/c/2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c Patch
https://git.kernel.org/stable/c/3599e6b3cc1ada96883d496a50a210d3afbb6987 Patch
https://git.kernel.org/stable/c/3884358a9286b17f389a72b1426fc4547c23c111 Patch
https://git.kernel.org/stable/c/3bd9e113d50034db99d7ef69fd8e5242d15e414a Patch
https://git.kernel.org/stable/c/760e1addc27ba1a7beb4a0a7e8b3e9ec49e7a34e Patch
https://git.kernel.org/stable/c/78bf6b6bb19541d19fbda6242e7cfe2c682763c0 Patch
https://git.kernel.org/stable/c/9d3e5fd19fe1063bf607219e8562fbd567b8e8d5 Patch
https://git.kernel.org/stable/c/f84eca5817390257cef78013d0112481c503b4a3 Patch
http://www.openwall.com/lists/oss-security/2026/05/13/5 Mailing List
http://www.openwall.com/lists/oss-security/2026/05/21/11 Mailing List
http://www.openwall.com/lists/oss-security/2026/05/21/12 Mailing List
http://www.openwall.com/lists/oss-security/2026/05/21/13 Mailing List
https://access.redhat.com/errata/RHBA-2026:20032 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:19521 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:19540 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:19568 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:19569 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:19664 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:19666 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:19705 Third Party Advisory

Sources

Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.

This product uses data from the NVD API but is not endorsed or certified by the NVD.