{"id":"CVE-2026-46300","published":"2026-05-23T12:17:02Z","modified":"2026-10-29T17:30:34Z","title":"Linux Kernel Missing Initialization of a Variable Vulnerability","vendor":"Linux","product":"Kernel","tier":"core","eol":null,"description":{"text":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: preserve shared-frag marker during coalescing\n\nskb_try_coalesce() can attach paged frags from @from to @to.  If @from\nhas SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same\nexternally-owned or page-cache-backed frags, but the shared-frag marker\nis currently lost.\n\nThat breaks the invariant relied on by later in-place writers.  In\nparticular, ESP input checks skb_has_shared_frag() before deciding\nwhether an uncloned nonlinear skb can skip skb_cow_data().  If TCP\nreceive coalescing has moved shared frags into an unmarked skb, ESP can\nsee skb_has_shared_frag() as false and decrypt in place over page-cache\nbacked frags.\n\nPropagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged\nfrags.  The tailroom copy path does not need the marker because it copies\nbytes into @to's linear data rather than transferring frag descriptors.","provenance":"source","from":"NVD"},"summary":{"text":"The Linux kernel's networking socket buffer code (net/skbuff, in skb_try_coalesce()) fails to preserve the shared-fragment marker when it transfers paged fragments from one skb to another, so the coalesced buffer no longer reflects that its fragments are externally owned or page-cache backed. An attacker with local access and low privileges, requiring no user interaction, can exploit this to cause in-place decryption over page-cache-backed data (for example through the ESP input path), which can lead to high confidentiality, integrity and availability impact on the affected system.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:11:03Z"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.1613,"percentile":0.96923,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2026-10-28","dueDate":"2026-10-31","ransomware":false,"requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: ; https://git.kernel.org/stable/c/3599e6b3cc1ada96883d496a50a210d3afbb6987 ; https://git.kernel.org/stable/c/2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c ; https://git.kernel.org/stable/c/9d3e5fd19fe1063bf607219e8562fbd567b8e8d5 ; https://git.kernel.org/stable/c/78bf6b6bb19541d19fbda6242e7cfe2c682763c0 ; https://git.kernel.org/stable/c/760e1addc27ba1a7beb4a0a7e8b3e9ec49e7a34e ; https://git.kernel.org/stable/c/3bd9e113d50034db99d7ef69fd8e5242d15e414a ; https://git.kernel.org/stable/c/3884358a9286b17f389a72b1426fc4547c23c111 ; https://git.kernel.org/stable/c/f84eca5817390257cef78013d0112481c503b4a3 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-46300","provenance":"source"},"vulncheckKev":{"dateAdded":"2026-08-03","exploitedFirstSeen":"2026-08-03","ransomware":false,"evidence":[{"url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/CrowdStrike-2026-Threat-Hunting-Report.pdf","date":"2026-08-03"},{"url":"https://securelist.com/vulnerabilities-and-exploits-in-q2-2026/121091/","date":"2026-08-26"},{"url":"https://www.nozominetworks.com/blog/kataru-iot-malware-adopts-public-lpe-exploits","date":"2026-09-09"},{"url":"https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers","date":"2026-10-26"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-10-28"}],"evidenceTotal":5,"provenance":"source"},"exploited":true,"otx":{"pulseCount":14,"pulses":[{"name":"Actively_Exploited_Kev | Oct 31, 2026","url":"https://otx.alienvault.com/pulse/6ae4aefab0c2191cecd41862","created":"2026-10-30"},{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"KATARU: IoT Malware Adopts Public LPE Exploits","url":"https://otx.alienvault.com/pulse/6aaa40418faac298d2664b18","created":"2026-09-16"},{"name":"KATARU: IoT Malware Adopts Public LPE Exploits","url":"https://otx.alienvault.com/pulse/6aa4409a4290cc035d81500c","created":"2026-09-11"},{"name":"New KATARU IoT Malware Packs Linux Privilege Escalation Exploits and Mirai-Style DDoS Attacks","url":"https://otx.alienvault.com/pulse/6aa4168a92213bfcc9f7010d","created":"2026-09-11"},{"name":"Known_Cve | Jun 1, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a1c426cbf0e554982e6da7a","created":"2026-05-31"},{"name":"Known_Cve | May 31, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a1af0efff4b7dd243573ef5","created":"2026-05-30"},{"name":"Known_Cve | May 30, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a199f66a765b0a5dce00131","created":"2026-05-29"},{"name":"Known_Cve | May 29, 2026","url":"https://otx.alienvault.com/pulse/6a184eb0b82a588940895fc7","created":"2026-05-28"},{"name":"Known_Cve | May 28, 2026","url":"https://otx.alienvault.com/pulse/6a16fc6bdf8b1c1279eacd4b","created":"2026-05-27"}],"provenance":"machine"},"cwes":[{"id":"CWE-787","name":"Out-of-bounds Write"},{"id":"CWE-456","name":"Missing Initialization of a Variable"},{"id":"CWE-123","name":"Write-what-where Condition"}],"references":[{"url":"https://git.kernel.org/stable/c/2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/3599e6b3cc1ada96883d496a50a210d3afbb6987","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/3884358a9286b17f389a72b1426fc4547c23c111","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/3bd9e113d50034db99d7ef69fd8e5242d15e414a","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/760e1addc27ba1a7beb4a0a7e8b3e9ec49e7a34e","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/78bf6b6bb19541d19fbda6242e7cfe2c682763c0","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/9d3e5fd19fe1063bf607219e8562fbd567b8e8d5","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/f84eca5817390257cef78013d0112481c503b4a3","tags":["Patch"]},{"url":"http://www.openwall.com/lists/oss-security/2026/05/13/5","tags":["Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2026/05/21/11","tags":["Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2026/05/21/12","tags":["Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2026/05/21/13","tags":["Mailing List"]},{"url":"https://access.redhat.com/errata/RHBA-2026:20032","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19521","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19540","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19568","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19569","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19664","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19666","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19705","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19711","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19875","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20051","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20054","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20087","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20129","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20130","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20299","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20593","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:21656","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:21690","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:21695","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:21702","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:23233","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:23240","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:23245","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:23468","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:23469","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:23470","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:23471","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24814","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25044","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:28887","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:33486","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34098","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-46300","tags":["Third Party Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477015","tags":["Third Party Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html","tags":["Third Party Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html","tags":["Third Party Advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46300.json","tags":["Issue Tracking","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-46300","tags":["US Government Resource"]}],"techniques":[{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: local privilege escalation via kernel memory corruption","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"ESP input checks skb_has_shared_frag() before deciding","start":441,"end":495}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-31535","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-31535","exploited":true,"exploitedSince":"2026-10-28","provenance":"source"},"exploits":[{"id":52591,"url":"https://www.exploit-db.com/exploits/52591","title":"Linux Kernel -  Local Privilege Escalation","type":"local","platform":"linux","date":"2026-05-29","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2026-05-29"},"pocGithub":{"count":12,"skipped":3,"earliest":"2026-05-14","earliestUrl":"https://github.com/HORKimhab/CVE-2026-46300","repos":[{"name":"0xredash/CVE-2026-46300","url":"https://github.com/0xredash/CVE-2026-46300","stars":16,"created":"2026-05-15"},{"name":"MadExploits/CVE-2026-46300","url":"https://github.com/MadExploits/CVE-2026-46300","stars":3,"created":"2026-06-30"},{"name":"HORKimhab/CVE-2026-46300","url":"https://github.com/HORKimhab/CVE-2026-46300","stars":2,"created":"2026-05-14"},{"name":"azilRababe/CVE-2026-46300","url":"https://github.com/azilRababe/CVE-2026-46300","stars":2,"created":"2026-06-22"},{"name":"Sentebale/CVE-2026-46300","url":"https://github.com/Sentebale/CVE-2026-46300","stars":1,"created":"2026-05-14"}]},"metasploit":[{"name":"Fragnesia LPE (CVE-2026-46300)","module":"exploit/linux/local/cve_2026_46300_fragnesia","type":"exploit","disclosureDate":"2026-05-14","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/cve_2026_46300_fragnesia.rb"}],"first":{"date":"2026-05-14","source":"PoC-in-GitHub","url":"https://github.com/HORKimhab/CVE-2026-46300"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1068"],"provenance":"ai"}],"timeline":[{"date":"2026-05-14","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Metasploit 2026-05-14, Exploit-DB 2026-05-29","url":"https://github.com/HORKimhab/CVE-2026-46300","provenance":"source"},{"date":"2026-05-23","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46300","provenance":"source"},{"date":"2026-08-03","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/CrowdStrike-2026-Threat-Hunting-Report.pdf","provenance":"source"},{"date":"2026-10-28","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2026-10-28","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-31535","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":158},"priority":{"score":77.5,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":10.0,"detail":"added 89 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.38,"detail":"percentile 0.9692"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 12 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":2.67,"detail":"14 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-linux-kernel-cwe-787"}}