CVE-2026-46300

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: skbuff: preserve shared-frag marker during coalescing

skb_try_coalesce() can attach paged frags from @from to @to. If @from

has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same

externally-owned or page-cache-backed frags, but the shared-frag marker

is currently lost.

That breaks the invariant relied on by later in-place writers. In

particular, ESP input checks skb_has_shared_frag() before deciding

whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP

receive coalescing has moved shared frags into an unmarked skb, ESP can

see skb_has_shared_frag() as false and decrypt in place over page-cache

backed frags.

Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged

frags. The tailroom copy path does not need the marker because it copies

bytes into @to's linear data rather than transferring frag descriptors.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References