CVE-2026-46300: Linux Kernel skb Coalescing Flaw Exposes Siemens S7-1500 MFP Controllers

Executive Summary

CVE-2026-46300 is a memory-handling defect in the Linux kernel networking stack where skb_try_coalesce() drops the SKBFL_SHARED_FRAG marker when merging paged fragments, allowing later in-place writers such as the IPsec ESP input path to modify externally owned or page-cache-backed memory without first copying it. On embedded controllers that run a Linux kernel, including Siemens SIMATIC and SIPLUS S7-1500 MFP firmware, this corruption sits directly in the receive path and can be reached by network traffic, which is the most exposed surface an OT device has.

Technical Exposure Breakdown

The flaw lives in skb_try_coalesce(). When this function attaches paged fragments from a source socket buffer into a destination socket buffer, and the source carries SKBFL_SHARED_FRAG, the destination inherits those fragments but loses the flag that says the fragments are shared. The marker exists so downstream code knows the backing pages are not exclusively owned and must not be written in place.

The concrete breakage is in ESP input. The IPsec receive path checks skb_has_shared_frag() to decide whether an uncloned nonlinear skb can skip skb_cow_data(), which is the copy-on-write step that guarantees a private, writable buffer. If TCP receive coalescing has already moved shared fragments into the skb and stripped the marker, ESP input believes the buffer is safe to decrypt in place when it is not. The result is in-place modification of memory the kernel does not own exclusively, which is a corruption primitive reachable through normal network input.

The vulnerable kernel range is broad. The grounding data lists affected ranges spanning 3.9 through 7.0.10 across multiple stable series, including 5.10.257 and earlier, 5.15.208 and earlier, 6.1.174 and earlier, 6.6.141 and earlier, 6.12.91 and earlier, and 6.18.33 and earlier. That is effectively every maintained long-term series, which is relevant because OT vendors tend to ship older LTS kernels inside controller firmware.

On the OT side, the grounding data identifies Siemens SIMATIC S7-1500 CPU 1518-4 PN firmware, 1518-4 PN/DP MFP firmware, 1518F-4 PN/DP MFP firmware, and the corresponding SIPLUS variants, with affected firmware versions 3.1.5 and later and 3.1.6 through 3.1.7. The MFP designation matters here. These are the multifunctional platform CPUs that run a Linux runtime alongside the control logic, which is precisely why a kernel networking defect lands on a programmable controller. CVSS is scored at 7.8. A public exploit is reported to exist, grade unknown. The vulnerability was flagged in the known exploited vulnerability catalog.

OT Impact and Compliance Risk

A corruption primitive in the receive path of a controller is a direct availability and integrity threat. If the condition is triggered, the realistic failure modes are a kernel fault that takes the control runtime offline and loss of the automation function that CPU is driving, or memory corruption that undermines the integrity of the IPsec termination the device relies on. On an S7-1500 class controller this is not abstract. It is the device executing the control loop.

Under IEC 62443, this maps to failures of SR 3.1 communication integrity and SR 7.1 denial of service protection, and it weakens any zone boundary that depended on IPsec on the affected device. For NERC CIP registered entities, a controller that can be faulted by crafted network input is a CIP-007 patch management and CIP-005 electronic security perimeter concern. Pipeline operators under TSA SD-02B and SD-02C should treat a network-reachable kernel flaw on a control device as a segmentation and critical cyber system integrity finding. Water utilities under AWIA 2018 risk and resilience obligations should log this against their control system risk register.

Compensating Controls

Do not run an active vulnerability scan against these controllers to confirm exposure. Active scanning of industrial components can brick them, and the defect itself is in the receive path, so malformed probe traffic is the wrong tool entirely. Build an inventory from engineering records and firmware version reads obtained through normal engineering channels.

Because the trigger is network input reaching the controller, the immediate control is to constrain who can send IP traffic to these CPUs. Restrict the device to a tightly defined set of engineering and HMI peers at the firewall and switch ACL layer, and drop everything else inbound. Where IPsec is terminated on the device, review whether that termination can be moved to a dedicated gateway so the controller stops parsing ESP input directly.

For virtual patching, place IPS inspection on the segment feeding the controllers and alert on anomalous fragmented TCP and ESP flows toward the affected IP ranges. A workable Suricata rule concept is to flag ESP traffic to controller addresses from sources outside the approved engineering allowlist, and to flag unusual volumes of small fragmented segments that could drive the coalescing path. These are detection and containment measures. They reduce reachability but do not remove the kernel defect, which only vendor firmware can.

BreachSpider Intel

BreachSpider tracks CVE-2026-46300 across affected Linux kernel ranges and Siemens S7-1500 MFP firmware, and monitors for exploitation signals relevant to OT asset owners.