# CVE-2026-46300: Linux Kernel Missing Initialization of a Variable

> A missing shared-frag marker in Linux kernel TCP coalescing allows ESP to decrypt in-place over page-cache backed fragments, potentially leading to memory corruption.

- **Severity:** High 7.8 (`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`)
- **Exploited in the wild:** Yes, since 28 Oct 2026 (CISA KEV)
- **Login needed:** Any signed-in user
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 23 May 2026
- **Updated:** 29 Oct 2026
- **Also known as:** AZL-87351, BELL-CVE-2026-46300, CLSA-2026-1778783204, CLSA-2026-1778783464, CLSA-2026-1778832730, CLSA-2026-1778832754, CLSA-2026-1778839666, CLSA-2026-1778863931, CLSA-2026-1778867412, CLSA-2026-1778930898, DEBIAN-CVE-2026-46300, GHSA-47jg-vqrv-5f8v, RHBA-2026:20032, ROOT-OS-DEBIAN-11-CVE-2026-46300, ROOT-OS-DEBIAN-12-CVE-2026-46300, ROOT-OS-DEBIAN-13-CVE-2026-46300, UBUNTU-CVE-2026-46300

## What is CVE-2026-46300?

CVE-2026-46300 is a high-severity memory corruption vulnerability in Linux kernel, published on 23 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

net: skbuff: preserve shared-frag marker during coalescing

skb_try_coalesce() can attach paged frags from @from to @to.  If @from
has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same
externally-owned or page-cache-backed frags, but the shared-frag marker
is currently lost.

That breaks the invariant relied on by later in-place writers.  In
particular, ESP input checks skb_has_shared_frag() before deciding
whether an uncloned nonlinear skb can skip skb_cow_data().  If TCP
receive coalescing has moved shared frags into an unmarked skb, ESP can
see skb_has_shared_frag() as false and decrypt in place over page-cache
backed frags.

Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged
frags.  The tailroom copy path does not need the marker because it copies
bytes into @to's linear data rather than transferring frag descriptors.

Weakness: CWE-787 (Out-of-bounds Write), CWE-123 (Write-what-where Condition), CWE-456 (Missing Initialization of a Variable)

## Which versions are affected by CVE-2026-46300?

It affects 8 products.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `openshift` | Red Hat:openshift:4.21::el10 | All versions | 0:4.21.0-202605142021.p2.geab2218.assembly.stream.el10 |
| `openshift-hyperkube` | Red Hat:openshift:4.21::el10 | All versions | 0:4.21.0-202605142021.p2.geab2218.assembly.stream.el10 |
| `openshift-kube-apiserver` | Red Hat:openshift:4.21::el10 | All versions | 0:4.21.0-202605142021.p2.geab2218.assembly.stream.el10 |
| `openshift-kube-controller-manager` | Red Hat:openshift:4.21::el10 | All versions | 0:4.21.0-202605142021.p2.geab2218.assembly.stream.el10 |
| `openshift-kube-scheduler` | Red Hat:openshift:4.21::el10 | All versions | 0:4.21.0-202605142021.p2.geab2218.assembly.stream.el10 |
| `openshift-kubelet` | Red Hat:openshift:4.21::el10 | All versions | 0:4.21.0-202605142021.p2.geab2218.assembly.stream.el10 |
| `openshift` | Red Hat:openshift:4.21::el8 | All versions | 0:4.21.0-202605142021.p2.geab2218.assembly.stream.el8 |
| `openshift-hyperkube` | Red Hat:openshift:4.21::el8 | All versions | 0:4.21.0-202605142021.p2.geab2218.assembly.stream.el8 |
| `kernel` | Red Hat:openshift:4.21::el9 | All versions | 0:5.14.0-570.116.1.el9_6 |
| `kernel-64k` | Red Hat:openshift:4.21::el9 | All versions | 0:5.14.0-570.116.1.el9_6 |
| `kernel-64k-core` | Red Hat:openshift:4.21::el9 | All versions | 0:5.14.0-570.116.1.el9_6 |
| `kernel-64k-debug` | Red Hat:openshift:4.21::el9 | All versions | 0:5.14.0-570.116.1.el9_6 |
| `kernel-64k-debug-core` | Red Hat:openshift:4.21::el9 | All versions | 0:5.14.0-570.116.1.el9_6 |
| `kernel-64k-debug-debuginfo` | Red Hat:openshift:4.21::el9 | All versions | 0:5.14.0-570.116.1.el9_6 |
| `kernel-64k-debug-devel` | Red Hat:openshift:4.21::el9 | All versions | 0:5.14.0-570.116.1.el9_6 |
| `kernel-64k-debug-devel-matched` | Red Hat:openshift:4.21::el9 | All versions | 0:5.14.0-570.116.1.el9_6 |
| `kernel-64k-debug-modules` | Red Hat:openshift:4.21::el9 | All versions | 0:5.14.0-570.116.1.el9_6 |
| `kernel-64k-debug-modules-core` | Red Hat:openshift:4.21::el9 | All versions | 0:5.14.0-570.116.1.el9_6 |
| `kernel-64k-debug-modules-extra` | Red Hat:openshift:4.21::el9 | All versions | 0:5.14.0-570.116.1.el9_6 |
| `kernel-64k-debug-modules-internal` | Red Hat:openshift:4.21::el9 | All versions | 0:5.14.0-570.116.1.el9_6 |
| `kernel-64k-debug-modules-partner` | Red Hat:openshift:4.21::el9 | All versions | 0:5.14.0-570.116.1.el9_6 |
| `kernel-64k-debuginfo` | Red Hat:openshift:4.21::el9 | All versions | 0:5.14.0-570.116.1.el9_6 |
| `kernel-64k-devel` | Red Hat:openshift:4.21::el9 | All versions | 0:5.14.0-570.116.1.el9_6 |
| `kernel-64k-devel-matched` | Red Hat:openshift:4.21::el9 | All versions | 0:5.14.0-570.116.1.el9_6 |
| `kernel-64k-modules` | Red Hat:openshift:4.21::el9 | All versions | 0:5.14.0-570.116.1.el9_6 |
| `kernel-64k-modules-core` | Red Hat:openshift:4.21::el9 | All versions | 0:5.14.0-570.116.1.el9_6 |
| `kernel-64k-modules-extra` | Red Hat:openshift:4.21::el9 | All versions | 0:5.14.0-570.116.1.el9_6 |
| `kernel-64k-modules-internal` | Red Hat:openshift:4.21::el9 | All versions | 0:5.14.0-570.116.1.el9_6 |
| `kernel-64k-modules-partner` | Red Hat:openshift:4.21::el9 | All versions | 0:5.14.0-570.116.1.el9_6 |
| `kernel-abi-stablelists` | Red Hat:openshift:4.21::el9 | All versions | 0:5.14.0-570.116.1.el9_6 |
| `kernel-core` | Red Hat:openshift:4.21::el9 | All versions | 0:5.14.0-570.116.1.el9_6 |
| `kernel-debug` | Red Hat:openshift:4.21::el9 | All versions | 0:5.14.0-570.116.1.el9_6 |
| `kernel-debug-core` | Red Hat:openshift:4.21::el9 | All versions | 0:5.14.0-570.116.1.el9_6 |
| `kernel-debug-debuginfo` | Red Hat:openshift:4.21::el9 | All versions | 0:5.14.0-570.116.1.el9_6 |
| `kernel-debug-devel` | Red Hat:openshift:4.21::el9 | All versions | 0:5.14.0-570.116.1.el9_6 |
| `kernel-debug-devel-matched` | Red Hat:openshift:4.21::el9 | All versions | 0:5.14.0-570.116.1.el9_6 |
| `kernel-debug-modules` | Red Hat:openshift:4.21::el9 | All versions | 0:5.14.0-570.116.1.el9_6 |
| `kernel-debug-modules-core` | Red Hat:openshift:4.21::el9 | All versions | 0:5.14.0-570.116.1.el9_6 |
| `kernel-debug-modules-extra` | Red Hat:openshift:4.21::el9 | All versions | 0:5.14.0-570.116.1.el9_6 |
| `kernel-debug-modules-internal` | Red Hat:openshift:4.21::el9 | All versions | 0:5.14.0-570.116.1.el9_6 |

Products: Linux kernel, Redhat Enterprise Linux, Redhat Enterprise Linux Aus, Redhat Enterprise Linux Eus, Redhat Enterprise Linux Tus, Redhat Enterprise Linux Update Services for Sap Solutions, Redhat Openshift Container Platform, Siemens Simatic S7-1500 Cpu 1518-4 Pn\/Dp Mfp Firmware.

## How do I fix CVE-2026-46300?

Apply the vendor's patch. US federal agencies must fix it by 31 Oct 2026.

## Is CVE-2026-46300 being exploited?

Yes. Attackers have exploited CVE-2026-46300 in the wild since at least 28 Oct 2026.

Public exploit code:

- CVE-2026-46300 (github_poc): https://github.com/0xredash/CVE-2026-46300
- CVE-2026-43284 - CVE-2026-43500 - CVE-2026-46300 Variant of dirtyfrag exploit (github_poc): https://github.com/MadExploits/CVE-2026-46300
- CVE-2026-46300 (github_poc): https://github.com/HORKimhab/CVE-2026-46300
- Technical analysis of CVE-2026-46300 (Fragnesia), a Linux kernel page-cache write vulnerability that enables local privilege escalation through SKBFL_SHARED_FRAG invariant violations in the networking stack. (github_poc): https://github.com/azilRababe/CVE-2026-46300
- https://github.com/Sentebale/CVE-2026-46300 (github_poc): https://github.com/Sentebale/CVE-2026-46300
- Add go CVE-2026-46300 (Fragnesia) local privilege escalation exploit (github_poc): https://github.com/1neptune/Fragnesia

## Other vulnerabilities in Linux kernel

- [CVE-2026-53266](https://insights.sbomify.com/CVE-2026-53266/): Linux Kernel Out-of-Bounds Write (high 8.8, exploited in the wild)
- [CVE-2013-6282](https://insights.sbomify.com/CVE-2013-6282/): Linux Kernel Improper Input Validation (high 8.8, exploited in the wild)
- [CVE-2022-0185](https://insights.sbomify.com/CVE-2022-0185/): Linux Kernel Heap-Based Buffer Overflow (high 8.4, exploited in the wild)
- [CVE-2013-2094](https://insights.sbomify.com/CVE-2013-2094/): Linux Kernel Privilege Escalation (high 8.4, exploited in the wild)
- [CVE-2026-53362](https://insights.sbomify.com/CVE-2026-53362/): Linux Kernel Unspecified (high 7.8, exploited in the wild)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-46300 and fix it if it is affected.

What it is: CVE-2026-46300 is a high-severity memory corruption vulnerability in Linux kernel, published on 23 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: Yes. Attackers have exploited CVE-2026-46300 in the wild since at least 28 Oct 2026.

Affected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-46300/ (Markdown: https://insights.sbomify.com/CVE-2026-46300/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-46300
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-46300
- OSV: https://osv.dev/vulnerability/CVE-2026-46300

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-46300/
Summaries are generated and may contain mistakes; the official description above is the record.