CVE-2026-46300: Linux Kernel

Should you act?

Exploited: patch now if you run it

CISA has confirmed exploitation in the wild. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

Yes, if you run Linux Kernel. CISA added this CVE to its Known Exploited Vulnerabilities catalog on 2026-10-28, which means there is reliable evidence of exploitation in the wild. US federal agencies must remediate by 2026-10-31; treat that as the outer limit, not the target.
EPSS 16.1%, percentile 97: FIRST’s model estimates a 16.1% chance of exploitation activity in the next 30 days, higher than 97% of all scored CVEs (very high). EPSS is a probability, not a verdict.
Needs local access needed. Lower urgency for most teams unless an attacker could already run code on the machine.
Editorial verdict: Act now. Fragnesia: Exploited Linux Kernel Root Bug CVE-2026-46300 — Any Linux host that runs untrusted or internet-facing code should be on a kernel with the May 2026 fix today; attackers are now using this public, race-free root exploit right after a web foothold.

What it is

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skbtrycoalesce() can attach paged frags from @from to @to. If @from has SKBFLSHAREDFRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skbhassharedfrag() before deciding whether an uncloned nonlinear skb can skip skbcowdata(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skbhassharedfrag() as false and decrypt in place over page-cache backed frags. Propagate SKBFLSHAREDFRAG when skbtrycoalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.

CISA’s summary

Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.

Weakness type: CWE-123, CWE-456.

Product: Linux Kernel · Assigned by: Linux · Published: 2026-05-23

Affected and fixed versions

Vendor	Product	Affected versions (per CVE record)
Linux	Linux	cef401de7be8c4e155c6746bfccf721a4fa5fab9 < 3599e6b3cc1ada96883d496a50a210d3afbb6987, cef401de7be8c4e155c6746bfccf721a4fa5fab9 < 2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c, cef401de7be8c4e155c6746bfccf721a4fa5fab9 < 9d3e5fd19fe1063bf607219e8562fbd567b8e8d5, cef401de7be8c4e155c6746bfccf721a4fa5fab9 <…
Linux	Linux	3.9

Severity scores

Scored by	CVSS	Score	Vector
Linux	3.1	7.8 High	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
redhat-SADP	3.1	7.8 High	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`

Attack vector: local access needed
Attack complexity: low
Privileges required: low (any account)
User interaction: none
Scope: unchanged

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

CISA KEV: added 2026-10-28; federal due date 2026-10-31. Known ransomware use: Unknown.
CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA SSVC assessment: exploitation active, automatable no, technical impact total.
FIRST EPSS (model of 2026-11-04): 16.13% probability of exploitation activity in the next 30 days; percentile 97.

Timeline

2026-05-23 — CVE record published by Linux
2026-10-28 — Added to CISA’s Known Exploited Vulnerabilities catalog
2026-10-28 — erroneo.us brief: Fragnesia: Exploited Linux Kernel Root Bug CVE-2026-46300
2026-10-29 — CVE record last updated
2026-10-31 — CISA remediation deadline for US federal agencies

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Other references from the CVE record and advisory

openwall.com openwall.com
openwall.com openwall.com
openwall.com openwall.com
openwall.com openwall.com
access.redhat.com access.redhat.com
RHBZ#2477015 bugzilla.redhat.com
security.access.redhat.com security.access.redhat.com
cert-portal.siemens.com cert-portal.siemens.com
cert-portal.siemens.com cert-portal.siemens.com

All exploited Linux vulnerabilities · Today’s Security Digest