CVE-2026-46300: Linux kernel bug breaks ESP frag isolation

Linux kernel bug breaks the invariant ESP relies on to decide safe in-place decryption.

CVE-2026-46300 affects the Linux kernel's networking function skb_try_coalesce(), used to merge packet buffers (skb) during data reception. When a source buffer has the SKBFL_SHARED_FRAG marker, indicating fragments shared with external memory or page-cache, this marker can be lost in the destination buffer after coalescing.

The issue impacts IPsec/ESP: the skb_has_shared_frag() check decides whether an uncloned buffer can skip the protective copy skb_cow_data() before decryption. If TCP coalescing moved shared fragments into an unmarked buffer, ESP can incorrectly decrypt directly over page-cache backed memory. Official CVSS score is 7.8 (high); published on NVD on May 23, 2026, already resolved. Not confirmed whether public exploits exist or active exploitation is occurring; unverified social posts were observed (54 in the last 24 hours).

For defenders, the priority is applying the kernel update with the fix as soon as available, prioritizing systems handling IPsec/ESP traffic or high-volume TCP connections. Consult your Linux vendor's security bulletins for patched versions, a detail not specified in the NVD description.

At a glance

What: The Linux kernel function skb_try_coalesce() can merge paged fragments from a buffer marked SKBFL_SHARED_FRAG (shared or page-cache backed) into another buffer without propagating that marker.
Severity: Official CVSS score is 7.8, classified as high.
Affected versions: Not reported in the provided NVD data: the official description does not specify exact Linux kernel versions involved.
Fix: The patch correctly propagates the SKBFL_SHARED_FRAG marker when skb_try_coalesce() transfers paged fragments, restoring the invariant expected by later checks such as skb_has_shared_frag() in ESP input.
Status: Vulnerability resolved and published on NVD on 2026-05-23; not confirmed in the data whether public exploits or active exploitation exist.
Action: Update the Linux kernel to the version containing the fix as soon as it is available for your distribution; check vendor security changelogs and apply any mitigations indicated through official channels.

Sources: NVD, CVE-2026-46300

← All articles