How severe is CVE-2026-46300?

CVE-2026-46300 has a CVSS score of 7.8/10, rated HIGH. Immediate patching is strongly recommended.

Which packages are affected by CVE-2026-46300?

CVE-2026-46300 affects the following packages: Kernel (Linux). Ecosystems affected: Linux.

How do I fix CVE-2026-46300?

Update Kernel to 5.10.257 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-46300 is resolved across your whole dependency graph.

How do I detect CVE-2026-46300 in my Linux dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for Kernel, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate CVE-2026-46300 if there is no patch (or I can't update yet)?

Constrain what reaches the vulnerable code: limit the size and shape of untrusted input, isolate the affected component in a sandboxed or least-privileged process, and enable the platform's memory-safety mitigations (ASLR, stack protector, hardened allocator) so an out-of-bounds access is more likely to fail closed than to be exploitable.

Is CVE-2026-46300 actively exploited in the wild?

Yes. There are 3 known exploit references for CVE-2026-46300, including 1 documented proof-of-concept exploit on Exploit-DB. Treat this as actively exploitable and prioritize patching immediately. All exploit code should only be run in an isolated sandbox environment for research or authorized testing — never against production systems without explicit written authorization.

What is the EPSS score for CVE-2026-46300?

CVE-2026-46300 has an EPSS (Exploit Prediction Scoring System) score of 10.2%, placing it in the 96th percentile of all CVEs. EPSS is maintained by FIRST.org and estimates the probability that a vulnerability will be exploited in the wild within the next 30 days. This score warrants monitoring and prompt remediation.

Is CVE-2026-46300 in the CISA Known Exploited Vulnerabilities catalog?

Yes. CVE-2026-46300 (Linux Kernel Missing Initialization of a Variable Vulnerability) was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on 2026-10-28. CISA required all US federal civilian agencies to remediate this vulnerability by 2026-10-31. The required action was: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Being listed in the KEV catalog is the strongest possible confirmation of active exploitation — treat this as a critical priority.

What type of vulnerability is CVE-2026-46300?

CVE-2026-46300 is classified as Out-of-bounds Write (CWE-787), CWE-456 (CWE-456), CWE-123 (CWE-123). These weakness types describe the underlying flaw category, which helps determine the potential impact and the right class of mitigation.

When was CVE-2026-46300 published, and has it been updated?

CVE-2026-46300 was published on May 23, 2026 and was last updated on October 28, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

🐧

🐧 Linux

CISA KEV · ACTIVELY EXPLOITED

HIGH severity

CVE-2026-46300 — Kernel

HIGH

CVE-2026-46300 is a high-severity (CVSS 7.8) Out-of-bounds Write vulnerability in Kernel. It is in CISA's Known Exploited Vulnerabilities catalog (added 2026-10-28) — treat it as actively exploited and patch now. A fix is available for Kernel — see the affected versions and patch details below.

net: skbuff: preserve shared-frag marker during coalescing

Published

May 23, 2026

Updated

Oct 28, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

3 known

Exploitation data as of Oct 27, 2026 · OSV.dev, NVD, CISA KEV, FIRST.org (EPSS)

Exploitation Status

Actively exploited in the wild

Confirmed by CISA's Known Exploited Vulnerabilities catalog on 2026-10-28. Federal agencies were required to remediate by 2026-10-31.
A successful exploit gives an attacker total control of the affected component, not partial access.

Exploitation and automatability from CISA (KEV catalog and SSVC triage) for CVE-2026-46300.

EPSS Exploitation Probability

via FIRST.org ↗

10.2%probability of exploitation in next 30 days

Moderate Risk+7.77%

Lower risk than most CVEs96th percentile — riskier than 96% of all scored CVEsHighest risk

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

CVE-2026-46300 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.

Where this sits among everything scored

Of 396,966 CVEs with a current EPSS score, this one falls in the 10–50% band (highlighted). Counts from FIRST.org, log-scaled.

Real-World Exposure

1 pkg affected

🐧Kernel

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Linux packages — download data is not available via public APIs for these ecosystems.

Description

In the Linux kernel, the following vulnerability has been resolved:

net: skbuff: preserve shared-frag marker during coalescing

skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost.

That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags.

Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
🐧Linux	`Kernel`	≥ 3.9.0&&< 5.10.257	5.10.257

Affected Products

1 product · 11 configurations

linux kernellinux

≥ 6.19 && ≤ 5.10.257

1 version

7.1

Exploits & PoCs

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

EDB-52591locallinux

Linux Kernel - Local Privilege Escalation

by nu11secur1ty · May 29, 2026

Exploit-DB Source

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for Kernel, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update Kernel to 5.10.257 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-46300 is resolved across your whole dependency graph.
Workarounds
Constrain what reaches the vulnerable code: limit the size and shape of untrusted input, isolate the affected component in a sandboxed or least-privileged process, and enable the platform's memory-safety mitigations (ASLR, stack protector, hardened allocator) so an out-of-bounds access is more likely to fail closed than to be exploitable.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatImportant

This issue is classified as Important, rather than Critical severity, because exploitation requires local access to the system. A low-privileged local attacker can exploit this flaw in the Linux kernel's XFRM ESP-in-TCP subsystem to gain root privileges by overwriting sensitive system files. Exploitation does not…

Workaround published by Red Hat

See the security bulletin for a detailed mitigation procedure.

Source: Red Hat security advisory for CVE-2026-46300 (CC BY 4.0)

Product	Fixed in	Advisory
NVIDIA for RHEL 10	`kernel-0:6.12.0-211.8.el10nv`	RHSA-2026:19540
NVIDIA for RHEL 10	`kernel-0:6.12.0-231.12.el10nv`	RHSA-2026:33486
Red Hat Enterprise Linux 10	`kernel-0:6.12.0-211.16.1.el10_2`	RHSA-2026:19569
Red Hat Enterprise Linux 10.0 Extended Update Support	`kernel-0:6.12.0-55.75.1.el10_0`	RHSA-2026:20299
Red Hat Enterprise Linux 8	`kernel-rt-0:4.18.0-553.125.1.rt7.466.el8_10`	RHSA-2026:19664
Red Hat Enterprise Linux 8	`kernel-0:4.18.0-553.125.1.el8_10`	RHSA-2026:19666
Red Hat Enterprise Linux 8	`kpatch-patch`	RHSA-2026:23470
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	`kernel-0:4.18.0-305.192.1.el8_4`	RHSA-2026:20130

UbuntuHIGH

USN-8370-1Ubuntu USN-8371-1Ubuntu USN-8373-1Ubuntu USN-8374-1Ubuntu USN-8388-1Ubuntu USN-8393-1Ubuntu USN-8426-1Ubuntu USN-8426-2Ubuntu

Frequently Asked Questions

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared f

O3 Security · Impact-Aware SCA

Is CVE-2026-46300 in your dependencies?

Find it across Linux, including transitive dependencies.

Scan my dependencies How O3 SCA works