PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46300 Linux CVE debrief

A vulnerability in the Linux kernel's network stack allows the SKBFL_SHARED_FRAG marker to be lost during socket buffer coalescing in skb_try_coalesce(). When TCP receive coalescing transfers paged fragments from one skb to another, the shared-frag marker indicating externally-owned or page-cache-backed memory is not propagated. This breaks an invariant relied upon by in-place writers, specifically ESP (Encapsulating Security Payload) input processing. ESP checks skb_has_shared_frag() to determine whether an uncloned nonlinear skb can skip skb_cow_data(). If the marker is missing due to prior coalescing, ESP may incorrectly perform in-place decryption over page-cache-backed fragments, leading to out-of-bounds write conditions. The vulnerability affects Linux kernel versions from 3.9 through 7.1-rc4. Patches are available from the stable kernel tree.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-11
Original CVE updated
2026-06-23
Advisory published
2026-06-11
Advisory updated
2026-06-23

Who should care

Linux system administrators running IPsec/ESP workloads; security teams managing VPN gateways; kernel maintainers for distributions shipping affected long-term support kernels

Technical summary

The vulnerability exists in net/core/skbuff.c where skb_try_coalesce() attaches paged fragments from a source skb to a destination skb without preserving the SKBFL_SHARED_FRAG flag. When the source skb has externally-owned fragments (e.g., from page cache or zero-copy receive), this marker indicates that in-place modification is unsafe. The ESP input path in net/ipv4/esp4.c and net/ipv6/esp6.c uses skb_has_shared_frag() as a guard before calling skb_cow_data() to ensure writable buffers. If coalescing has stripped the marker, ESP proceeds with in-place decryption, potentially writing decrypted plaintext over page-cache pages. This constitutes an out-of-bounds write (CWE-787) with local attack vector and high impact to confidentiality, integrity, and availability. The fix propagates SKBFL_SHARED_FRAG when paged fragments are transferred during coalescing.

Defensive priority

HIGH

Recommended defensive actions

  • Apply stable kernel patches for affected versions (5.10.258+, 5.15.209+, 6.1.175+, 6.6.142+, 6.12.92+, 6.18.34+, 7.0.11+, or 7.1-rc5+)
  • Prioritize patching systems handling IPsec/ESP traffic with TCP segmentation offload enabled
  • Monitor for kernel updates from distribution vendors for long-term support releases
  • Review systems running kernel versions 3.9 through 7.1-rc4 for exposure to IPsec workloads

Evidence notes

CVE published 2026-05-23; modified 2026-05-26. NVD analysis confirms affected versions spanning 3.9 through 7.1-rc4. Multiple stable kernel patches released.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46300 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46300

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46300 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46300

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/3599e6b3cc1ada96883d496a50a210d3afbb6987

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/3884358a9286b17f389a72b1426fc4547c23c111

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/3bd9e113d50034db99d7ef69fd8e5242d15e414a

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/760e1addc27ba1a7beb4a0a7e8b3e9ec49e7a34e

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/78bf6b6bb19541d19fbda6242e7cfe2c682763c0

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/9d3e5fd19fe1063bf607219e8562fbd567b8e8d5

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.