CVE-2026-46300

This vulnerability is in how the Linux kernel processes network packets. Under certain packet-handling conditions, it can forget a safety label about shared memory fragments, which can lead to wrong behavior—like crashes or corrupted data—when the network stack later tries to modify those fragments. Think of it like losing a “do not edit directly” sticky note on shared pages: later steps may edit in place when they shouldn’t.

This matters if you run Linux kernel versions on these products: linux kernel, astra linux, red hat enterprise linux, red hat openshift container platform, AlmaLinux, red os, and red hat enterprise linux for nvidia. The attack is described as local with low authentication and no user interaction, so it’s mainly a concern where an attacker can run or influence requests from the same system context that triggers the kernel networking paths. The risk depends on reachability into the kernel networking processing that uses the coalescing behavior; exact “default exposure” is not yet known from the findings.

Verdict: AMBER. Even though no CISA KEV entry and no clear dated public exploitation report were found, this is a kernel memory-handling issue that can cause crashes or data corruption when triggered by a local low-auth attacker. Prioritize patching on affected systems through your standard update pipeline, especially on hosts where untrusted local users or services may be present.

1. Confirm exposure (affected kernel):

• Identify kernel versions on your relevant servers/VMs/containers that use the Linux kernel, including RHEL/Astra/Alma/Rocky-like derivatives and OpenShift nodes.
• Determine whether the installed kernel build corresponds to a version before the vendor backport of the fix.

2. Determine whether the fix is present:

• Your target is a kernel build that includes one of the provided fixed commits:
  • 3599e6b3cc1ada96883d496a50a210d3afbb6987
  • 2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c
  • 9d3e5fd19fe1063bf607219e8562fbd567b8e8d5
  • 78bf6b6bb19541d19fbda6242e7cfe2c682763c0
  • 760e1addc27ba1a7beb4a0a7e8b3e9ec49e7a34e
  • 3bd9e113d50034db99d7ef69fd8e5242d15e414a
  • 3884358a9286b17f389a72b1426fc4547c23c111
  • f84eca5817390257cef78013d0112481c503b4a3
• Use your vendor’s kernel/package changelog for “skbuff”/“shared-frag marker”/CVE-2026-46300 coverage.

3. Upgrade path:

• Upgrade via the standard vendor-supported method (for example, your distribution’s update channel). This CVE’s fix is in the Linux kernel code and is typically delivered through vendor kernel updates.
• Plan a reboot if your vendor requires it for kernel changes.

4. Workaround if patching is delayed:

• Follow your vendor’s temporary guidance/workarounds as provided in their advisory (the findings note that workarounds exist, though the exact details are not included in the provided text).

5. What to monitor after remediation:

• Look for kernel/network stability issues: crashes/reboots, networking errors, and any system logs indicating memory faults or networking stack failures.
• If you run OpenShift or other platforms on Kubernetes, include node-level monitoring because the kernel runs on the nodes.

6. Timing:

• No CISA KEV due date was provided in the findings because CVE-2026-46300 is not listed in the KEV set here. Given the AMBER verdict and “rising” patch attention, treat this as a priority for the next update cycle for affected systems.

CVE-2026-46300 affects the Linux kernel networking code path around skb_try_coalesce() and fragment coalescing. The weakness is CWE-787 (Out-of-bounds Write / misuse patterns related to memory safety invariants in this context), triggered because skb_try_coalesce() can transfer paged fragments from one skb to another while losing the SKBFL_SHARED_FRAG marker when the source has SKBFL_SHARED_FRAG set. Later in-place writers rely on skb_has_shared_frag() to decide whether they can skip copy-on-write behavior; if coalescing moves shared frags into an unmarked skb, ESP processing may decrypt in place over page-cache-backed fragments, violating the invariant and risking corruption or instability.

Findings indicate: attack vector is local with low authentication and no user interaction; crashes/unexpected behavior and data corruption are plausible outcomes. No KEV listing and no public exploit code on record were found, and press reports did not provide a clear dated exploitation claim. Exploit maturity is therefore not confirmed as widespread; predicted EPSS exists in the findings but is not used for owner-facing urgency. The practical mitigation is to deploy the kernel fix via the vendor updates that include one of the fixed commits listed in the findings.