CVE-2026-46300: Linux Kernel skb_try_coalesce() Shared-Fragment Flaw
CVE-2026-46300 is a Linux kernel flaw in skb_try_coalesce() that drops the shared-fragment marker when merging packet buffer fragments, letting IPsec ESP input processing treat a still-shared, externally-owned fragment as safe to modify in place and so disclose or corrupt data it should not touch; CISA added it to the KEV catalog on 2026-10-28 citing active exploitation, and the same kernel defect is separately patched in the embedded GNU/Linux subsystem of the Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP, fixed in firmware V3.1.7.
Vulnerability summary
| Vulnerability ID | CVE-2026-46300 |
|---|---|
| CVSS score | 7.8 |
| EPSS score | 0.10192 |
| CISA KEV | Yes — in the Known Exploited Vulnerabilities catalog |
| Source | NVD |
| Published | 2026-05-23T12:17:02.660 |
Affected components
| Component | CPE | Version range |
|---|---|---|
| Linux Kernel | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 3.9 through 5.10.257, 5.11 through 5.15.207, 5.16 through 6.1.173, 6.2 through 6.6.140, 6.7 through 6.12.90, 6.13 through 6.18.32, 6.19 through 7.0.9, and 7.1-rc1 through 7.1-rc4; each affected stable branch is fixed by the patches published at git.kernel.org |
| Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (additional GNU/Linux subsystem) | cpe:2.3:o:siemens:simatic_s7-1500_cpu_1518-4_pn-dp_mfp_firmware:*:*:*:*:*:*:*:* | V3.1.6 and later, before V3.1.7 (fixed in V3.1.7) |
What this means
CVE-2026-46300 is a missing-initialization / shared-fragment-tracking bug (CWE-787/CWE-456) in skb_try_coalesce() in the Linux kernel's net/core/skbuff.c. NVD's description quotes the kernel fix commit directly: "skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost" (NVD). Losing that marker breaks the invariant relied on by in-place writers: IPsec ESP input can then decide a merged buffer has no shared fragments when it actually does, and decrypt or overwrite data in place over memory that is still owned elsewhere (page cache or another socket), risking disclosure or corruption of unrelated data for a local, low-privileged attacker (AV:L/AC:L/PR:L in the NVD vector).
NVD lists the CVSS v3.1 base score as 7.8 (HIGH), vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, with [email protected] as the scoring source (NVD). NVD's own record still shows the CVE as "Undergoing Analysis" as of 2026-10-28, but because the vulnerability is on the CISA Known Exploited Vulnerabilities catalog we treat it as indexable and cite the NVD-sourced score rather than labelling it pending.
CISA added CVE-2026-46300 to KEV on 2026-10-28 with a short, three-day remediation window (due 2026-10-31) under Binding Operational Directive 26-04, and notes it can be chained with two separate PHP memory-safety bugs (CVE-2026-109618, CVE-2026-109619) to deploy webshells and run commands as root on exposed hosts; known ransomware use is listed as "Unknown" (CISA KEV).
The affected kernel line spans eight stable branches, from 3.9 through the 7.1 release candidates; the fix lives in the stable-tree backport commits published at kernel.org, for example commit 3599e6b3cc1a on the stable branch (Linux stable tree). Because the bug sits in core skbuff handling rather than a single driver, it also reaches embedded Linux builds shipped inside OT/ICS products: Siemens' own PSIRT advisory SSA-019113 lists CVE-2026-46300 among the vulnerabilities fixed in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP, affected from firmware V3.1.6 and fixed in V3.1.7 (Siemens PSIRT Advisory SSA-019113).
As of 2026-10-28, FIRST scores the probability of exploitation at 0.10192 (95.65th percentile) — markedly higher than a typical unexploited CVE, consistent with the fresh KEV listing (FIRST EPSS).
Because this is a kernel-level, local-to-the-host issue that CISA already lists as exploited, any Linux host — generic server, container host, or an embedded OT device such as the affected Siemens S7-1500 CPU variant — running a kernel in the vulnerable ranges should apply the relevant stable kernel update (or Siemens firmware V3.1.7) before the 2026-10-31 BOD 26-04 deadline.
Evidence
- skb_try_coalesce() loses the SKBFL_SHARED_FRAG marker when merging packet buffer fragments, letting IPsec ESP input decrypt/modify data in place over a still-shared, externally-owned fragment. — NVD
- CVSS v3.1 base score 7.8 (HIGH), vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, scored by [email protected]. — NVD
- Added to the CISA KEV catalog on 2026-10-28, due 2026-10-31 under BOD 26-04; can be chained with CVE-2026-109618/CVE-2026-109619; known ransomware use listed as Unknown. — CISA KEV
- Affects Linux kernel stable branches 3.9 through 7.1-rc4; fixed by the stable-tree backport commits, e.g. commit 3599e6b3cc1a. — Linux kernel stable tree
- Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP additional GNU/Linux subsystem is affected from firmware V3.1.6, fixed in V3.1.7. — Siemens PSIRT Advisory SSA-019113
- EPSS score is 0.10192 (95.651th percentile) as of 2026-10-28. — FIRST EPSS