Vulnerability report

Exploitation attempts observed in the wild Confirmed confidence In CISA KEV

CVE-2026-46300

net: skbuff: preserve shared-frag marker during coalescing

Linux · affected before *

Watch CVE-2026-46300 Browse KEV feed
Severity
CVSS 7.8 · High
Confidence
Confirmed
Exploit status
Exploitation attempts observed in the wild
EPSS
10.2%
First observed
—
Last observed
—

Decision summary

What security teams need to know first

Direct answers before the deeper technical record.

What it is

CVE-2026-46300 is net: skbuff: preserve shared-frag marker during coalescing affecting Linux. In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during...

Have exploitation attempts been observed?

Yes. Exploitation attempts have been reported for this vulnerability. Previdian lists it as a known exploited vulnerability. Listed in CISA KEV. Also reported by third-party sources. Confidence is confirmed.

Who is affected?

Linux affected before *.

What should we do?

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

Overview

net: skbuff: preserve shared-frag marker during coalescing

In the Linux kernel, the following vulnerability has been resolved:

net: skbuff: preserve shared-frag marker during coalescing

skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost.

That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags.

Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.

Red Hat Unaffected
NVIDIA for RHEL 10 kernel
Before *
Red Hat Unaffected
Red Hat Enterprise Linux 10 kernel
Before *
Red Hat Unaffected
Red Hat Enterprise Linux 10.0 Extended Update Support kernel
Before *
Red Hat Unaffected
Red Hat Enterprise Linux 8 kernel-rt
Before *
Red Hat Unaffected
Red Hat Enterprise Linux 8 kernel
Before *
Red Hat Unaffected
Red Hat Enterprise Linux 8 kpatch-patch
All versions (default: unaffected)
Red Hat Unaffected
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support kernel
Before *
Red Hat Unaffected
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On kernel
Before *
Red Hat Unaffected
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support kernel
Before *
Red Hat Unaffected
Red Hat Enterprise Linux 8.6 Telecommunications Update Service kernel
Before *
Red Hat Unaffected
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions kernel
Before *
Red Hat Unaffected
Red Hat Enterprise Linux 8.8 Telecommunications Update Service kernel
Before *
Red Hat Unaffected
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions kernel
Before *
Red Hat Unaffected
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions kpatch-patch
All versions (default: unaffected)
Red Hat Unaffected
Red Hat Enterprise Linux 9 kernel
Before *
Red Hat Unaffected
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions kernel
Before *
Red Hat Unaffected
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions kernel-rt
Before *
Red Hat Unaffected
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions kernel
Before *
Red Hat Unaffected
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions kernel-rt
Before *
Red Hat Unaffected
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions kpatch-patch
All versions (default: unaffected)
Red Hat Unaffected
Red Hat Enterprise Linux 9.4 Extended Update Support kernel
Before *
Red Hat Unaffected
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions kpatch-patch
All versions (default: unaffected)
Red Hat Unaffected
Red Hat Enterprise Linux 9.6 Extended Update Support kernel
Before *
Red Hat Unaffected
Red Hat Enterprise Linux 9.6 Extended Update Support kpatch-patch
All versions (default: unaffected)
Red Hat Unaffected
Red Hat OpenShift Container Platform 4.12 rhcos
Before *
Red Hat Unaffected
Red Hat OpenShift Container Platform 4.13 rhcos
Before *
Red Hat Unaffected
Red Hat OpenShift Container Platform 4.14 rhcos
Before *
Red Hat Unaffected
Red Hat OpenShift Container Platform 4.15 rhcos
Before *
Red Hat Unaffected
Red Hat OpenShift Container Platform 4.16 rhcos
Before *
Red Hat Unaffected
Red Hat OpenShift Container Platform 4.17 rhcos
Before *
Red Hat Unaffected
Red Hat OpenShift Container Platform 4.18 rhcos
Before *
Red Hat Unaffected
Red Hat OpenShift Container Platform 4.19 rhcos
Before *
Red Hat Unaffected
Red Hat OpenShift Container Platform 4.20 rhcos
Before *
Red Hat Unaffected
Red Hat OpenShift Container Platform 4.21 kernel
Before *
Red Hat Unaffected
Red Hat OpenShift Container Platform 4.21 openshift
Before *
Red Hat Unaffected
Red Hat OpenShift Container Platform 4.21 rhcos
Before *
Red Hat Unaffected
Red Hat Enterprise Linux 6 kernel
All versions (default: unaffected)
Red Hat Unaffected
Red Hat Enterprise Linux 7 kernel
All versions (default: unaffected)
Red Hat Unaffected
Red Hat Enterprise Linux 7 kernel-rt
All versions (default: unaffected)
Siemens Affected
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
Before V3.1.7 Before *
Siemens Affected
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
Before V3.1.7 Before *
Siemens Affected
SIPLUS S7-1500 CPU 1518-4 PN/DP MFP
Before V3.1.7 Before *
Linux Affected
Linux
Before 3599e6b3cc1ada96883d496a50a210d3afbb6987 Before 2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c Before 9d3e5fd19fe1063bf607219e8562fbd567b8e8d5 Before 78bf6b6bb19541d19fbda6242e7cfe2c682763c0 Before 760e1addc27ba1a7beb4a0a7e8b3e9ec49e7a34e Before 3bd9e113d50034db99d7ef69fd8e5242d15e414a Before 3884358a9286b17f389a72b1426fc4547c23c111 Before f84eca5817390257cef78013d0112481c503b4a3 3.9
Linux Unaffected
Linux
Before 3.9 Through 5.10.* Through 5.15.* Through 6.1.* Through 6.6.* Through 6.12.* Through 6.18.* Through 7.0.* Through *
Published
23 May 2026
Exploitation Attempts Reported
28 Oct 2026
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None

Tags

linux cisa

CVE References

Exploitation evidence

Evidence of exploitation attempts

Third-party attestation and first-party sensor observation are shown separately so teams can judge the evidence chain.

Exploitation attempts observed in the wild

Dream

Recorded 28 Oct 2026

A trusted third party reported exploitation attempts.

Proof of concept available

GitHub

Recorded 20 May 2026

Public scanner or PoC coverage increases practical exploitability.

Known exploited vulnerability sources

Per-source evidence links for KEV attestations are available through the Previdian Pro API.

Learn about Pro API access
Source Added
Dream First 2026-10-28 17:26 UTC
CISA 2026-10-28 19:50 UTC

Detection

Operational artifacts and observed signals

Make the evidence actionable in scanner, SOC, and edge-control workflows.

Virtual patch status

No Previdian virtual patch is currently available. Future rules ship for ModSecurity, Cloudflare, and AWS WAF.

Learn about virtual patches →

Scanner Artifacts

Scanner and exploit-framework references linked to this CVE.

Scanner Reference Detected
Metasploit https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/cve_2026_46300_fragnesia.rb 14 May 2026

Risk and context

Severity, weaknesses, and research context

CVSS v3.1

7.8 High

Potential damage if exploited. Separate from whether attackers are using it.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

10.2%

Estimated chance of exploitation in the next 30 days. Previdian's warning comes from evidence, not this score.

Weaknesses

Write-what-where Condition CWE-123 Missing Initialization of a Variable CWE-456

Recent mention · The Hacker News

PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network

Ravie LakshmananOct 28, 2026Vulnerability / Cyber Espionage Cybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected China-nexus threat actor that has leveraged the PHP2Shell...

Read full advisory

All Mentions

Recent mention · The Hacker News

PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network

The Hacker News · 28 Oct 2026

Ravie LakshmananOct 28, 2026Vulnerability / Cyber Espionage Cybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected China-nexus threat actor that has leveraged the PHP2Shell vulnerabilities to breach exposed systems. The activity, which was observed on October 25, 2026, involved an attacker combining PHP2Shell with a kernel privilege escalation exploit to root 25 servers, including three systems in a U.S. government-affiliated environment. "The affected devices run specific versions of a large...

Recent mention · Rapid7

Metasploit Wrap Up: Lot of summer shells and fit http profiles

Rapid7 · 14 Aug 2026

This wrap-up brings a full-on shell parade. Thirteen shiny new modules landed, starting with a buffet of RCEs. WordPress WP2Shell, Ghost CMS, Joomla JCE, Langflow, OpenCATS, Pterodactyl Panel, SonicWall SMA1000, Ray Dashboard, a Pix-for-WooCommerce, and for those who like their exploits closer to the bare-metal, the Fragnesia Linux kernel LPE (CVE-2026-46300). Metasploit also got the glow-up of the summer with the new http malleable profiles, MCP functionality and linux multi fetch payloads (more details on the [official 6.5 release blog...

Recent mention · All CISA Advisories

Impact of Linux Kernel vulnerabilities on B&R products

All CISA Advisories · 23 Jun 2026

View CSAF Summary B&R is aware of publicly reported vulnerabilities affecting the Linux kernel versions shipped with the products listed as affected in the advisory. Successful local exploitation of these vulnerabilities could allow an attacker to escalate privileges on the affected system. Public proof-of-concept exploits are available for the vulnerabilities described herein. At the time of publication of this advisory, B&R had no evidence of active exploitation targeting B&R products. The following versions of Impact of Linux Kernel vulnerabilities on B&R products are affected: Linux...

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

Kentox493/CVE-2026-46300_Fragnesia

github · Created 2026-08-14 15:00:50 UTC · 0 stars · AI assessment 90%

Timeline

From disclosure to observed exploitation attempts

  1. 19:50 UTC

    Added to CISA KEV

    Listed in the CISA Known Exploited Vulnerabilities catalog

  2. 17:26 UTC

    Added to Previdian KEV Feed

    High-confidence, third-party report of exploitation attempts

  3. 15:00 UTC

    Public PoC available

    Public proof-of-concept code published

  4. 11:44 UTC

    CVE published

    Vulnerability disclosed publicly

  5. 00:00 UTC

    Metasploit module available

    Exploit module available

  6. 15:03 UTC

    CVE ID reserved

    Identifier reserved by the CNA

Pro API

Automate this intelligence

Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

Start 14-day Pro trial Read API docs
  • Evidence confidence and provenance
  • First-party sensor telemetry
  • PoC and scanner references
  • Affected versions and enrichment
  • Automation-ready JSON delivery

GET /api/v2/pro/kevs/CVE-2026-46300

Sample API response 
{
  "cve_id": "CVE-2026-46300",
  "confidence": "Confirmed",
  "cvss_score": 7.8,
  "cvss_estimated": false,
  "epss_score": 0.10192,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "attempts": 0, "sensors": 0 }
}