LiveActive security incident?Get immediate response
CVE Record

CVE-2026-46300: net: skbuff: preserve shared-frag marker during coalescing

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysis

Security readout for executives and security teams

A Linux kernel networking flaw can let the encryption subsystem write over memory it should not touch. When network packets get merged, an internal "shared" flag was dropped, so later code assumed the data was safe to modify. On affected systems, a local attacker or workload could trigger memory corruption, crashes, or possible privilege escalation. Linux and Red Hat have shipped fixes. Any Linux system in the affected version ranges (5.10.x, 5.15.x, 6.1.x, 6.6.x, 6.12.x, 6.18.x, 7.0.x pre-fix) that terminates IPsec/ESP traffic and uses TCP receive coalescing. Servers, gateways, and container hosts running IPsec VPNs, and RHEL derivatives listed in the referenced advisories, are the highest-value targets to patch first. Treat as a standard-cycle high-severity Linux kernel patch. No evidence of active exploitation, but the flaw affects IPsec data paths on widely deployed kernels and vendors have already published fixes. Schedule reboots into the next maintenance window, and expedite on hosts that terminate VPNs or handle multi-tenant workloads. Mitigation focus: Apply the stable kernel updates referenced in the git.kernel.org commits for your branch.; Deploy Red Hat kernel errata RHSA-2026:19540, 21690, 21695, and 33486 where applicable.; Prioritize patching hosts that terminate IPsec/ESP tunnels or run kTLS with coalesced receive paths..

Prepared

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-123: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-46300 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

2CVSS vectors
5Timeline events
2ADP providers
45Source links

CVSS vector scores

2 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9redhat-SADP

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2026-46300Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. ADP timelineredhat-SADP

    Made public.

  2. ADP timelineredhat-SADP

    Reported to Red Hat.

  3. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  4. CVE publishedCVE Program

    The CVE record was published.

  5. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
redhat-SADPkernel: "Fragnesia" is a variant of Dirty Frag vulnerability in the ESP/XFRM leading to Local Privilege Escalation (LPE) vulnerability in the Linux kernel
other:Red Hat severity ratingcvssV3_1
  • 2026-05-13T13:28:21.270Z: Reported to Red Hat.
  • 2026-05-13T12:00:00.000Z: Made public.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxcef401de7be8c4e155c6746bfccf721a4fa5fab9, cef401de7be8c4e155c6746bfccf721a4fa5fab9, cef401de7be8c4e155c6746bfccf721a4fa5fab9, cef401de7be8c4e155c6746bfccf721a4fa5fab9, cef401de7be8c4e155c6746bfccf721a4fa5fab9, cef401de7be8c4e155c6746bfccf721a4fa5fab9, cef401de7be8c4e155c6746bfccf721a4fa5fab9, cef401de7be8c4e155c6746bfccf721a4fa5fab9unaffected
LinuxLinux3.9, 0, 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10, 7.1affected
Weakness

CWE details

CWE-123

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-123 · source CWE mapping

Write-what-where Condition

Write-what-where Condition represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs