CVE-2026-46300
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @fr...
Affects 2 products across 2 vendors.
Software writes data past buffer boundaries, corrupting memory and potentially enabling code execution.
A high severity vulnerability affects Unknown vendor systems (CVE-2026-46300). A proof-of-concept has been published. Apply available vendor patches promptly.
• Model: rule-based-v1 • Confidence: LOW
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2026-46300?
What is the CVSS score for CVE-2026-46300?
Is CVE-2026-46300 actively exploited?
How do I remediate CVE-2026-46300?
What systems are affected by CVE-2026-46300?
| CVE ID | CVE-2026-46300 |
|---|---|
| CVSS Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| Published | 2026-07-28 |
| Last Modified | 2026-10-19 |
| ICS Relevance | 70% |
| Weakness (CWE) | |
| Source | NVD |
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.
Source: NIST NVD / MITRE CVE Database
Vulnerability details: In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whet CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Exploitation Likelihood: MEDIUM
| Vendor | Product | Affected Versions |
|---|---|---|
| Linux | Linux Kernel | 7.1 ≥ 3.9, ≤ 5.10.257 ≥ 5.11, < 5.15.208 ≥ 5.16, < 6.1.174 ≥ 6.2, < 6.6.141 ≥ 6.7, < 6.12.91+2 more≥ 6.13, < 6.18.33 ≥ 6.19, < 7.0.10 |
| Linux | Linux | 3.9 |
| Siemens | — | — |
| Siemens | Simatic S7-1500 Cpu 1518-4 Pn/Dp Mfp Firmware | ≥ 3.1.5 |
| Siemens | Simatic S7-1500 Cpu 1518-4 Pn Firmware | ≥ 3.1.5 |
| Siemens | Simatic S7-1500 Cpu 1518F-4 Pn/Dp Mfp Firmware | ≥ 3.1.5 |
| Siemens | Siplus S7-1500 Cpu 1518-4 Pn/Dp Mfp Firmware | ≥ 3.1.5 |
| CISA known-exploited | ● Active Exploitation Confirmed (added 2026-10-28) |
|---|---|
| Public Exploit | ⚠ Available — Reference |
| PoC Code | Not confirmed |
AI Enrichment Record — provenance & audit hash
| Model | rule-based-v1 |
|---|---|
| Confidence | LOW |
| Enriched At | 2026-05-27 |
| SHA-512 Audit Hash | 5ae5383589d83105737290848edc2ca57e0af373a9ff9abdd68521a385262e73c209a2abd647ff6374edcae501e06816990126811cb5ca210c2ae3811d4ecbfa |
This Vulnerability Is Being Actively Exploited
CVE-2026-46300 is on the CISA known-exploited list - confirmed active exploitation in the wild. BreachSpider flags known-exploited CVEs on the ICS assets they affect, with known-exploited status synced daily from CISA.
Create a free account →