Buffer overflow in Linux

CVE-2026-46300

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.

Vulnerability class: Buffer Overflow

Published · last modified .

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.024 (83.9th percentile), scored .

Low probability of exploitation in the next 30 days, but still tracked. 84th percentile — 83.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-46300: fell from 0.093 to 0.024.

EPSS over last 30 days · oldest: 0.093 · newest: 0.024 · change: -0.069

Affected products

  • Linux — versions cef401de7be8c4e155c6746bfccf721a4fa5fab9, 6.1.174, 6.6.141
  • Linux Kernel — versions 7.1

Weakness classification (CWE)

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2026-46300?
CVE-2026-46300 is a high-severity vulnerability in Linux, classified under Out-of-bounds Write. CVSS score: 7.8/10. Published 2026-05-23.
How severe is CVE-2026-46300?
High severity. CVSS v3 base score is 7.8 out of 10.
Is CVE-2026-46300 known to be exploited?
18 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.