CVE-2026-46300: Linux Kernel Missing Initialization of a Variable Vulnerability

Published May 13, 2026
·
Updated

Fragnesia is a universal Linux local privilege escalation exploit, discovered by William Bowling with the V12 team. Fragnesia is a member of the Dirty Frag vulnerability class. This is a separate bug in the ESP/XFRM from dirtyfrag which has received its own patch. However, it is in the same surface and the mitigation is the same as for dirtyfrag.

It abuses a logic bug in the Linux XFRM ESP-in-TCP subsystem to achieve arbitrary byte writes into the kernel page cache of read-only files, without requiring any race condition.

The technique extends the page-cache write bug class that includes Dirty Pipe: when a TCP socket transitions to espintcp ULP mode after data has already been spliced from a file into the receive queue, the kernel processes the queued file pages as ESP ciphertext. The AES-GCM keystream byte at counter block position 2, byte 0 is XORed directly into the cached file page. By selecting the IV nonce to produce a desired keystream byte, any target byte in the file can be set to any value — one byte per trigger invocation.

The exploit builds a 256-entry lookup table mapping each possible keystream byte to its corresponding nonce, then iterates over a payload, firing the splice/ULP race for each byte that needs changing. It writes a small position-independent ELF stub (setresuid/setresgid/execve /bin/sh) over the first 192 bytes of /usr/bin/su in the page cache, then calls execve("/usr/bin/su") to obtain a root shell. The page cache modification is not backed to disk; the on-disk binary is untouched.

Other sources

In the Linux kernel, the following vulnerability has been resolved:

net: skbuff: preserve shared-frag marker during coalescing

skbtrycoalesce() can attach paged frags from @from to @to. If @from has SKBFLSHAREDFRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost.

That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skbhassharedfrag() before deciding whether an uncloned nonlinear skb can skip skbcowdata(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skbhassharedfrag() as false and decrypt in place over page-cache backed frags.

Propagate SKBFLSHAREDFRAG when skbtrycoalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.

— OSV

Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.

— CISA

Affected Software

255 affected componentsFixes available
Linux Linux kernel
Microsoft azl3 kernel 6.6.139.1-1<6.6.141.1-1
6.6.141.1-1
Linux Kernel
Linux Linux kernel>=3.9<=5.10.257
Linux Linux kernel>=5.11<5.15.208
Linux Linux kernel>=5.16<6.1.174
Linux Linux kernel>=6.2<6.6.141
Linux Linux kernel>=6.7<6.12.91
Linux Linux kernel>=6.13<6.18.33
Linux Linux kernel>=6.19<7.0.10
Linux Linux kernel=7.1-rc1
Linux Linux kernel=7.1-rc2
Linux Linux kernel=7.1-rc3
Linux Linux kernel=7.1-rc4
All of the following
Siemens Simatic S7-1500 Cpu 1518-4 Pn\/dp Mfp Firmware>=3.1.5<=3.1.6
Siemens Simatic S7-1500 Cpu 1518-4 Pn\/dp Mfp
redhat OpenShift Container Platform>=4.12<4.12.91
redhat OpenShift Container Platform>=4.13<4.13.67
redhat OpenShift Container Platform>=4.14<4.14.68
redhat OpenShift Container Platform>=4.15<4.15.65
redhat OpenShift Container Platform>=4.16<4.16.63
redhat OpenShift Container Platform>=4.17<4.17.55
redhat OpenShift Container Platform>=4.18<4.18.43
redhat OpenShift Container Platform>=4.19<4.19.33
redhat OpenShift Container Platform>=4.20<4.20.24
redhat OpenShift Container Platform>=4.21<4.21.17
redhat Enterprise Linux=6.0
redhat Enterprise Linux=7.0
redhat Enterprise Linux=8.0
redhat Enterprise Linux=9.0
redhat Enterprise Linux=10.0
redhat Enterprise Linux Aus=8.4
redhat Enterprise Linux Aus=8.6
redhat Enterprise Linux Eus=8.4
redhat Enterprise Linux Eus=9.4
redhat Enterprise Linux Eus=9.6
redhat Enterprise Linux Eus=10.0
redhat Enterprise Linux Tus=8.6
redhat Enterprise Linux Tus=8.8
redhat Enterprise Linux Update Services For Sap Solutions=8.6
redhat Enterprise Linux Update Services For Sap Solutions=8.8
redhat Enterprise Linux Update Services For Sap Solutions=9.0
redhat Enterprise Linux Update Services For Sap Solutions=9.2
redhat Enterprise Linux Update Services For Sap Solutions=9.4
ubuntu/linux-hwe-edge*
ubuntu/linux-aws-5.0*
ubuntu/linux-aws-5.3*
ubuntu/linux-azure*
ubuntu/linux-azure-5.3*
ubuntu/linux-azure-edge*
ubuntu/linux-gcp*
ubuntu/linux-gcp-5.3*
ubuntu/linux-gke-4.15*
ubuntu/linux-gke-5.4*
ubuntu/linux-gkeop-5.4*
ubuntu/linux-hwe*
ubuntu/linux-hwe-edge*
ubuntu/linux-oem*
ubuntu/linux-oracle-5.0*
ubuntu/linux-oracle-5.3*
ubuntu/linux-aws-5.11*
ubuntu/linux-aws-5.13*
ubuntu/linux-aws-5.15<5.15.0-1109.116~20.04.1
5.15.0-1109.116~20.04.1
ubuntu/linux-aws-5.8*
ubuntu/linux-azure-5.11*
ubuntu/linux-azure-5.13*
ubuntu/linux-azure-5.15<5.15.0-1114.123~20.04.1
5.15.0-1114.123~20.04.1
ubuntu/linux-azure-5.8*
ubuntu/linux-azure-fde*
ubuntu/linux-gcp-5.11*
ubuntu/linux-gcp-5.13*
ubuntu/linux-gcp-5.15<5.15.0-1109.118~20.04.1
5.15.0-1109.118~20.04.1
ubuntu/linux-gcp-5.8*
ubuntu/linux-gke*
ubuntu/linux-gke-5.15*
ubuntu/linux-gkeop*
ubuntu/linux-gkeop-5.15*
ubuntu/linux-hwe-5.11*
ubuntu/linux-hwe-5.13*
ubuntu/linux-hwe-5.15<5.15.0-181.191~20.04.1
5.15.0-181.191~20.04.1
ubuntu/linux-hwe-5.8*
ubuntu/linux-ibm-5.15<5.15.0-1103.106~20.04.1
5.15.0-1103.106~20.04.1
ubuntu/linux-intel-5.13*
ubuntu/linux-intel-iotg-5.15<5.15.0-1104.110~20.04.1
5.15.0-1104.110~20.04.1
ubuntu/linux-lowlatency-hwe-5.15<5.15.0-181.191~20.04.1
5.15.0-181.191~20.04.1
ubuntu/linux-nvidia-tegra-5.15<5.15.0-1061.61~20.04.1
5.15.0-1061.61~20.04.1
ubuntu/linux-oem-5.10*
ubuntu/linux-oem-5.13*
ubuntu/linux-oem-5.6*
ubuntu/linux-oracle-5.11*
ubuntu/linux-oracle-5.13*
ubuntu/linux-oracle-5.15<5.15.0-1106.112~20.04.1
5.15.0-1106.112~20.04.1
ubuntu/linux-oracle-5.8*
ubuntu/linux-raspi2*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.11*
ubuntu/linux-riscv-5.15<5.15.0-1103.107~20.04.1
5.15.0-1103.107~20.04.1
ubuntu/linux-riscv-5.8*
ubuntu/linux<5.15.0-181.191
5.15.0-181.191
ubuntu/linux-allwinner-5.19*
ubuntu/linux-aws<5.15.0-1109.116
5.15.0-1109.116
ubuntu/linux-aws-5.19*
ubuntu/linux-aws-6.2*
ubuntu/linux-aws-6.5*
ubuntu/linux-aws-6.8<6.8.0-1057.60~22.04.1
6.8.0-1057.60~22.04.1
ubuntu/linux-azure<5.15.0-1114.123
5.15.0-1114.123
ubuntu/linux-azure-5.19*
ubuntu/linux-azure-6.2*
ubuntu/linux-azure-6.5*
ubuntu/linux-azure-6.8<6.8.0-1059.65~22.04.1
6.8.0-1059.65~22.04.1
ubuntu/linux-azure-fde<5.15.0-1114.123
5.15.0-1114.123
ubuntu/linux-azure-fde-5.19*
ubuntu/linux-azure-fde-6.2*
ubuntu/linux-azure-fde-6.8<6.8.0-1058.65~22.04.1
6.8.0-1058.65~22.04.1
ubuntu/linux-gcp<5.15.0-1109.118
5.15.0-1109.118
ubuntu/linux-gcp-5.19*
ubuntu/linux-gcp-6.2*
ubuntu/linux-gcp-6.5*
ubuntu/linux-gcp-6.8<6.8.0-1060.63~22.04.1
6.8.0-1060.63~22.04.1
ubuntu/linux-gke<5.15.0-1105.111
5.15.0-1105.111
ubuntu/linux-gkeop<5.15.0-1092.100
5.15.0-1092.100
ubuntu/linux-hwe-5.19*
ubuntu/linux-hwe-6.2*
ubuntu/linux-hwe-6.5*
ubuntu/linux-hwe-6.8<6.8.0-124.124~22.04.1
6.8.0-124.124~22.04.1
ubuntu/linux-ibm<5.15.0-1103.106
5.15.0-1103.106
ubuntu/linux-ibm-6.8<6.8.0-1057.58~22.04.1
6.8.0-1057.58~22.04.1
ubuntu/linux-intel-iot-realtime*
ubuntu/linux-intel-iotg<5.15.0-1104.110
5.15.0-1104.110
ubuntu/linux-kvm<5.15.0-1101.106
5.15.0-1101.106
ubuntu/linux-lowlatency<5.15.0-181.191
5.15.0-181.191
ubuntu/linux-lowlatency-hwe-5.19*
ubuntu/linux-lowlatency-hwe-6.2*
ubuntu/linux-lowlatency-hwe-6.5*
ubuntu/linux-lowlatency-hwe-6.8<6.8.0-134.134.1~22.04.1
6.8.0-134.134.1~22.04.1
ubuntu/linux-nvidia<5.15.0-1104.105
5.15.0-1104.105
ubuntu/linux-nvidia-6.2*
ubuntu/linux-nvidia-6.5*
ubuntu/linux-nvidia-6.8<6.8.0-1055.58~22.04.1
6.8.0-1055.58~22.04.1
ubuntu/linux-nvidia-tegra<5.15.0-1061.61
5.15.0-1061.61
ubuntu/linux-nvidia-tegra-igx<5.15.0-1050.50
5.15.0-1050.50
ubuntu/linux-oem-5.17*
ubuntu/linux-oem-6.0*
ubuntu/linux-oem-6.1*
ubuntu/linux-oem-6.5*
ubuntu/linux-oracle<5.15.0-1106.112
5.15.0-1106.112
ubuntu/linux-oracle-6.5*
ubuntu/linux-oracle-6.8<6.8.0-1054.55~22.04.1
6.8.0-1054.55~22.04.1
ubuntu/linux-raspi<5.15.0-1103.106
5.15.0-1103.106
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.19*
ubuntu/linux-riscv-6.5*
ubuntu/linux-riscv-6.8<6.8.0-124.124~22.04.1
6.8.0-124.124~22.04.1
ubuntu/linux-starfive-5.19*
ubuntu/linux-starfive-6.2*
ubuntu/linux-starfive-6.5*
ubuntu/linux-xilinx-zynqmp<5.15.0-1074.78
5.15.0-1074.78
ubuntu/linux-bluefield<5.15.0-1093.95
5.15.0-1093.95
ubuntu/linux-intel-iot-realtime<5.15.0-1101.103
5.15.0-1101.103
ubuntu/linux-realtime<5.15.0-1108.117
5.15.0-1108.117
ubuntu/linux-realtime-6.8<6.8.1-1052.53~22.04.1
6.8.1-1052.53~22.04.1
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux-aws-fips<5.15.0-1109.116+fips1
5.15.0-1109.116+fips1
ubuntu/linux-azure-fips<5.15.0-1114.123+fips1
5.15.0-1114.123+fips1
ubuntu/linux-fips<5.15.0-181.191+fips1
5.15.0-181.191+fips1
ubuntu/linux-gcp-fips<5.15.0-1109.118+fips1
5.15.0-1109.118+fips1
ubuntu/linux<6.8.0-124.124
6.8.0-124.124
ubuntu/linux-aws<6.8.0-1057.60
6.8.0-1057.60
ubuntu/linux-aws-6.14*
ubuntu/linux-aws-6.17<6.17.0-1017.17~24.04.1
6.17.0-1017.17~24.04.1
ubuntu/linux-azure<6.8.0-1058.64
6.8.0-1058.64
ubuntu/linux-azure-6.11*
ubuntu/linux-azure-6.14*
ubuntu/linux-azure-6.17<6.17.0-1017.17~24.04.1
6.17.0-1017.17~24.04.1
ubuntu/linux-azure-fde<6.8.0-1058.65
6.8.0-1058.65
ubuntu/linux-azure-fde-6.14*
ubuntu/linux-azure-nvidia*
ubuntu/linux-azure-nvidia-6.14*
ubuntu/linux-gcp<6.8.0-1060.63
6.8.0-1060.63
ubuntu/linux-gcp-6.11*
ubuntu/linux-gcp-6.14*
ubuntu/linux-gcp-6.17<6.17.0-1018.19~24.04.1
6.17.0-1018.19~24.04.1
ubuntu/linux-gke<6.8.0-1055.61
6.8.0-1055.61
ubuntu/linux-gkeop<6.8.0-1042.45
6.8.0-1042.45
ubuntu/linux-hwe-6.11*
ubuntu/linux-hwe-6.14*
ubuntu/linux-hwe-6.17<6.17.0-35.35~24.04.1
6.17.0-35.35~24.04.1
ubuntu/linux-hwe-7.0<7.0.0-28.28~24.04.1
7.0.0-28.28~24.04.1
ubuntu/linux-ibm<6.8.0-1057.58
6.8.0-1057.58
ubuntu/linux-lowlatency<6.8.0-134.134.1
6.8.0-134.134.1
ubuntu/linux-lowlatency-hwe-6.11*
ubuntu/linux-nvidia<6.8.0-1055.58
6.8.0-1055.58
ubuntu/linux-nvidia-6.11*
ubuntu/linux-nvidia-6.17<6.17.0-1021.21
6.17.0-1021.21
ubuntu/linux-nvidia-lowlatency<6.8.0-1055.58.1
6.8.0-1055.58.1
ubuntu/linux-nvidia-tegra<6.8.0-1026.26
6.8.0-1026.26
ubuntu/linux-oem-6.11*
ubuntu/linux-oem-6.14*
ubuntu/linux-oem-6.17<6.17.0-1024.24
6.17.0-1024.24
ubuntu/linux-oem-6.8*
ubuntu/linux-oracle<6.8.0-1054.55
6.8.0-1054.55
ubuntu/linux-oracle-6.14*
ubuntu/linux-oracle-6.17<6.17.0-1016.16~24.04.1
6.17.0-1016.16~24.04.1
ubuntu/linux-raspi<6.8.0-1057.61
6.8.0-1057.61
ubuntu/linux-raspi-realtime*
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-riscv-6.14*
ubuntu/linux-riscv-6.17<6.17.0-35.35.1~24.04.1
6.17.0-35.35.1~24.04.1
ubuntu/linux-xilinx<6.8.0-1032.33
6.8.0-1032.33
ubuntu/linux-bluefield<6.8.0-1023.27
6.8.0-1023.27
ubuntu/linux-raspi-realtime<6.8.0-2046.47
6.8.0-2046.47
ubuntu/linux-realtime<6.8.1-1052.53
6.8.1-1052.53
ubuntu/linux-realtime-6.14*
ubuntu/linux-realtime-6.17<6.17.0-1014.16~24.04.1
6.17.0-1014.16~24.04.1
ubuntu/linux-aws-fips<6.8.0-1057.60+fips1
6.8.0-1057.60+fips1
ubuntu/linux-azure-fips<6.8.0-1059.65+fips1
6.8.0-1059.65+fips1
ubuntu/linux-fips<6.8.0-124.124+fips1
6.8.0-124.124+fips1
ubuntu/linux-gcp-fips<6.8.0-1060.63+fips1
6.8.0-1060.63+fips1
ubuntu/linux<6.17.0-35.35
6.17.0-35.35
ubuntu/linux-aws<6.17.0-1017.17
6.17.0-1017.17
ubuntu/linux-azure<6.17.0-1017.17
6.17.0-1017.17
ubuntu/linux-azure-fde*
ubuntu/linux-gcp<6.17.0-1018.19
6.17.0-1018.19
ubuntu/linux-oracle<6.17.0-1016.16
6.17.0-1016.16
ubuntu/linux-raspi<6.17.0-1018.18
6.17.0-1018.18
ubuntu/linux-realtime<6.17.0-1014.16
6.17.0-1014.16
ubuntu/linux-riscv<6.17.0-35.35.1
6.17.0-35.35.1
ubuntu/linux<7.0.0-22.22
7.0.0-22.22
ubuntu/linux-aws<7.0.0-1006.6
7.0.0-1006.6
ubuntu/linux-azure<7.0.0-1007.7
7.0.0-1007.7
ubuntu/linux-azure-fde<7.0.0-1006.6
7.0.0-1006.6
ubuntu/linux-gcp<7.0.0-1005.5
7.0.0-1005.5
ubuntu/linux-ibm<7.0.0-1007.7
7.0.0-1007.7
ubuntu/linux-nvidia<7.0.0-1009.9
7.0.0-1009.9
ubuntu/linux-oem-7.0<7.0.0-1008.8
7.0.0-1008.8
ubuntu/linux-oracle<7.0.0-1005.5
7.0.0-1005.5
ubuntu/linux-raspi<7.0.0-1011.11
7.0.0-1011.11
ubuntu/linux-realtime<7.0.0-22.22.1
7.0.0-22.22.1
ubuntu/linux-riscv<7.0.0-22.22.1
7.0.0-22.22.1
debian/linux<6.1.174-1
6.1.174-1
debian/linux<6.12.90-1
6.12.90-1
debian/linux<7.0.9-1
7.0.9-1
linux/kernel>=3.9.0<5.10.257
5.10.257
linux/kernel>=5.11.0<5.15.208
5.15.208
linux/kernel>=5.16.0<6.1.174
6.1.174
linux/kernel>=6.2.0<6.6.141
6.6.141
linux/kernel>=6.7.0<6.12.91
6.12.91
linux/kernel>=6.13.0<6.18.33
6.18.33
linux/kernel>=6.19.0<7.0.10
7.0.10
debian/linux
6.1.176-16.1.190-16.12.107-16.12.115-27.2.12-17.2.15-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 6.6.141.1-1
  2. Upgrade

    Upgrade ubuntu/linux-aws-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1109.116~20.04.1
  3. Upgrade

    Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1114.123~20.04.1
  4. Upgrade

    Upgrade ubuntu/linux-gcp-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1109.118~20.04.1
  5. Upgrade

    Upgrade ubuntu/linux-hwe-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-181.191~20.04.1
  6. Upgrade

    Upgrade ubuntu/linux-ibm-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1103.106~20.04.1
  7. Upgrade

    Upgrade ubuntu/linux-intel-iotg-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1104.110~20.04.1
  8. Upgrade

    Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-181.191~20.04.1
  9. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1061.61~20.04.1
  10. Upgrade

    Upgrade ubuntu/linux-oracle-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1106.112~20.04.1
  11. Upgrade

    Upgrade ubuntu/linux-riscv-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1103.107~20.04.1
  12. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 5.15.0-181.191
  13. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 5.15.0-1109.116
  14. Upgrade

    Upgrade ubuntu/linux-aws-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1057.60~22.04.1
  15. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 5.15.0-1114.123
  16. Upgrade

    Upgrade ubuntu/linux-azure-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1059.65~22.04.1
  17. Upgrade

    Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.

    Fixed in 5.15.0-1114.123
  18. Upgrade

    Upgrade ubuntu/linux-azure-fde-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1058.65~22.04.1
  19. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 5.15.0-1109.118
  20. Upgrade

    Upgrade ubuntu/linux-gcp-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1060.63~22.04.1
  21. Upgrade

    Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.

    Fixed in 5.15.0-1105.111
  22. Upgrade

    Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.

    Fixed in 5.15.0-1092.100
  23. Upgrade

    Upgrade ubuntu/linux-hwe-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-124.124~22.04.1
  24. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 5.15.0-1103.106
  25. Upgrade

    Upgrade ubuntu/linux-ibm-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1057.58~22.04.1
  26. Upgrade

    Upgrade ubuntu/linux-intel-iotg to a version that resolves this vulnerability.

    Fixed in 5.15.0-1104.110
  27. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 5.15.0-1101.106
  28. Upgrade

    Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.

    Fixed in 5.15.0-181.191
  29. Upgrade

    Upgrade ubuntu/linux-lowlatency-hwe-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-134.134.1~22.04.1
  30. Upgrade

    Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.

    Fixed in 5.15.0-1104.105
  31. Upgrade

    Upgrade ubuntu/linux-nvidia-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1055.58~22.04.1
  32. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.

    Fixed in 5.15.0-1061.61
  33. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra-igx to a version that resolves this vulnerability.

    Fixed in 5.15.0-1050.50
  34. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 5.15.0-1106.112
  35. Upgrade

    Upgrade ubuntu/linux-oracle-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1054.55~22.04.1
  36. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 5.15.0-1103.106
  37. Upgrade

    Upgrade ubuntu/linux-riscv-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-124.124~22.04.1
  38. Upgrade

    Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.

    Fixed in 5.15.0-1074.78
  39. Upgrade

    Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.

    Fixed in 5.15.0-1093.95
  40. Upgrade

    Upgrade ubuntu/linux-intel-iot-realtime to a version that resolves this vulnerability.

    Fixed in 5.15.0-1101.103
  41. Upgrade

    Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.

    Fixed in 5.15.0-1108.117
  42. Upgrade

    Upgrade ubuntu/linux-realtime-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.1-1052.53~22.04.1
  43. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 5.15.0-1109.116+fips1
  44. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 5.15.0-1114.123+fips1
  45. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 5.15.0-181.191+fips1
  46. Upgrade

    Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.

    Fixed in 5.15.0-1109.118+fips1
  47. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 6.8.0-124.124
  48. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 6.8.0-1057.60
  49. Upgrade

    Upgrade ubuntu/linux-aws-6.17 to a version that resolves this vulnerability.

    Fixed in 6.17.0-1017.17~24.04.1
  50. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 6.8.0-1058.64
  51. Upgrade

    Upgrade ubuntu/linux-azure-6.17 to a version that resolves this vulnerability.

    Fixed in 6.17.0-1017.17~24.04.1
  52. Upgrade

    Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.

    Fixed in 6.8.0-1058.65
  53. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 6.8.0-1060.63
  54. Upgrade

    Upgrade ubuntu/linux-gcp-6.17 to a version that resolves this vulnerability.

    Fixed in 6.17.0-1018.19~24.04.1
  55. Upgrade

    Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.

    Fixed in 6.8.0-1055.61
  56. Upgrade

    Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.

    Fixed in 6.8.0-1042.45
  57. Upgrade

    Upgrade ubuntu/linux-hwe-6.17 to a version that resolves this vulnerability.

    Fixed in 6.17.0-35.35~24.04.1
  58. Upgrade

    Upgrade ubuntu/linux-hwe-7.0 to a version that resolves this vulnerability.

    Fixed in 7.0.0-28.28~24.04.1
  59. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 6.8.0-1057.58
  60. Upgrade

    Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.

    Fixed in 6.8.0-134.134.1
  61. Upgrade

    Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.

    Fixed in 6.8.0-1055.58
  62. Upgrade

    Upgrade ubuntu/linux-nvidia-6.17 to a version that resolves this vulnerability.

    Fixed in 6.17.0-1021.21
  63. Upgrade

    Upgrade ubuntu/linux-nvidia-lowlatency to a version that resolves this vulnerability.

    Fixed in 6.8.0-1055.58.1
  64. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.

    Fixed in 6.8.0-1026.26
  65. Upgrade

    Upgrade ubuntu/linux-oem-6.17 to a version that resolves this vulnerability.

    Fixed in 6.17.0-1024.24
  66. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 6.8.0-1054.55
  67. Upgrade

    Upgrade ubuntu/linux-oracle-6.17 to a version that resolves this vulnerability.

    Fixed in 6.17.0-1016.16~24.04.1
  68. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 6.8.0-1057.61
  69. Upgrade

    Upgrade ubuntu/linux-riscv-6.17 to a version that resolves this vulnerability.

    Fixed in 6.17.0-35.35.1~24.04.1
  70. Upgrade

    Upgrade ubuntu/linux-xilinx to a version that resolves this vulnerability.

    Fixed in 6.8.0-1032.33
  71. Upgrade

    Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.

    Fixed in 6.8.0-1023.27
  72. Upgrade

    Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.

    Fixed in 6.8.0-2046.47
  73. Upgrade

    Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.

    Fixed in 6.8.1-1052.53
  74. Upgrade

    Upgrade ubuntu/linux-realtime-6.17 to a version that resolves this vulnerability.

    Fixed in 6.17.0-1014.16~24.04.1
  75. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-1057.60+fips1
  76. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-1059.65+fips1
  77. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-124.124+fips1
  78. Upgrade

    Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-1060.63+fips1
  79. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 6.17.0-35.35
  80. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 6.17.0-1017.17
  81. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 6.17.0-1017.17
  82. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 6.17.0-1018.19
  83. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 6.17.0-1016.16
  84. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 6.17.0-1018.18
  85. Upgrade

    Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.

    Fixed in 6.17.0-1014.16
  86. Upgrade

    Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.

    Fixed in 6.17.0-35.35.1
  87. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 7.0.0-22.22
  88. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 7.0.0-1006.6
  89. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 7.0.0-1007.7
  90. Upgrade

    Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.

    Fixed in 7.0.0-1006.6
  91. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 7.0.0-1005.5
  92. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 7.0.0-1007.7
  93. Upgrade

    Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.

    Fixed in 7.0.0-1009.9
  94. Upgrade

    Upgrade ubuntu/linux-oem-7.0 to a version that resolves this vulnerability.

    Fixed in 7.0.0-1008.8
  95. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 7.0.0-1005.5
  96. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 7.0.0-1011.11
  97. Upgrade

    Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.

    Fixed in 7.0.0-22.22.1
  98. Upgrade

    Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.

    Fixed in 7.0.0-22.22.1
  99. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 6.1.174-1
  100. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 6.12.90-1
  101. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 7.0.9-1
  102. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.14-1
  103. Upgrade

    Upgrade linux/Kernel to a version that resolves this vulnerability.

    Fixed in 5.10.257
  104. Upgrade

    Upgrade linux/Kernel to a version that resolves this vulnerability.

    Fixed in 5.15.208
  105. Upgrade

    Upgrade linux/Kernel to a version that resolves this vulnerability.

    Fixed in 6.1.174
  106. Upgrade

    Upgrade linux/Kernel to a version that resolves this vulnerability.

    Fixed in 6.6.141
  107. Upgrade

    Upgrade linux/Kernel to a version that resolves this vulnerability.

    Fixed in 6.12.91
  108. Upgrade

    Upgrade linux/Kernel to a version that resolves this vulnerability.

    Fixed in 6.18.33
  109. Upgrade

    Upgrade linux/Kernel to a version that resolves this vulnerability.

    Fixed in 7.0.10
  110. Compensating control

    Apply the kernel mitigation that propagates the SKBFL_SHARED_FRAG marker when skb_try_coalesce() transfers paged fragments, preserving the shared-fragment marker during socket-buffer coalescing.

Event History

May 13, 2026
Data Sourced
via Red Hat·01:40 PM
DescriptionSeverityAffected Software
May 14, 2026
News Published
via BleepingComputer·07:30 AM
News Published
via BleepingComputer·07:34 AM
May 23, 2026
CVE Published
via MITRE·11:44 AM
Data Sourced
via MITRE·11:44 AM
DescriptionSeverity
Data Sourced
via OSV·11:44 AM
DescriptionSeverityAffected Software
Data Sourced
via NVD·12:17 PM
RemedyDescriptionSeverityWeaknessAffected Software
May 27, 2026
Data Sourced
via Microsoft·08:01 AM
DescriptionSeverityWeaknessAffected Software
May 29, 2026
Exploit Published
via ExploitDB·12:00 AM
Oct 28, 2026
Data Sourced
via CISA·12:00 AM
RemedyDescriptionWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

1

What is the severity of CVE-2026-46300?

The severity of CVE-2026-46300 is rated as high with a score of 7.

2

What systems are affected by CVE-2026-46300?

CVE-2026-46300 affects the Linux kernel.

3

How do I fix CVE-2026-46300?

To fix CVE-2026-46300, apply the latest security patches provided for the Linux kernel.

4

What type of vulnerability is CVE-2026-46300?

CVE-2026-46300 is categorized as a race condition vulnerability.

5

What is the potential impact of CVE-2026-46300?

The potential impact of CVE-2026-46300 is local privilege escalation to root privileges.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203