CVE-2026-46300 Linux Kernel Missing Initialization of a Variable Vulnerability
Active exploitation observed
· CISA KEV catalogueDescription
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux 7.1 | earliest → < 7.1 | 7.1 |
| Linux 7.0 | earliest → < 7.0.10 | 7.0.10 |
| Linux 6.18 | earliest → < 6.18.33 | 6.18.33 |
| Linux 6.12 | earliest → < 6.12.91 | 6.12.91 |
| Linux 6.6 | earliest → < 6.6.141 | 6.6.141 |
| Linux 6.1 | earliest → < 6.1.174 | 6.1.174 |
| Linux 5.15 | earliest → < 5.15.208 | 5.15.208 |
| Linux 5.10 | earliest → < 5.10.257 | 5.10.257 |
| Linux | 3.9 | No fix stated |
Show the 77 other branches Hide the 77 other branches
References
- git.kernel.org git.kernel.org
- git.kernel.org git.kernel.org
- git.kernel.org git.kernel.org
- git.kernel.org git.kernel.org
- git.kernel.org git.kernel.org
- git.kernel.org git.kernel.org
- git.kernel.org git.kernel.org
- git.kernel.org git.kernel.org
Timeline
- Published
- Added to the KEV catalogue
- Last modified