Connect your agent
AdvisoriesCriticalCheck your lockfilePluginHow it worksPricing Connect your agent

CVE record · CVE-2026-46300

net: skbuff: preserve shared-frag marker during coalescing

CVSS 7.8 HighCriticalIn CISA KEVEPSS 0.16 · 96th percentile

Critical, because:

  • In CISA’s KEV catalogue since 28 Oct 2026: it is known to be exploited.
  • CVSS score 7.8 (7.0 or more) and EPSS 0.16 (0.1 or more): a high score and a real chance of exploitation in the next 30 days.

How we decide what’s critical

Published by the CVE Program (CNA: Linux) at 23 May 2026, 11:44 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
VendorProductVersions
Linux Linux
  • affected cef401de7be8c4e155c6746bfccf721a4fa5fab9 to before 3599e6b3cc1ada96883d496a50a210d3afbb6987 git
  • affected cef401de7be8c4e155c6746bfccf721a4fa5fab9 to before 2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c git
  • affected cef401de7be8c4e155c6746bfccf721a4fa5fab9 to before 9d3e5fd19fe1063bf607219e8562fbd567b8e8d5 git
  • affected cef401de7be8c4e155c6746bfccf721a4fa5fab9 to before 78bf6b6bb19541d19fbda6242e7cfe2c682763c0 git
  • affected cef401de7be8c4e155c6746bfccf721a4fa5fab9 to before 760e1addc27ba1a7beb4a0a7e8b3e9ec49e7a34e git
  • affected cef401de7be8c4e155c6746bfccf721a4fa5fab9 to before 3bd9e113d50034db99d7ef69fd8e5242d15e414a git
  • affected cef401de7be8c4e155c6746bfccf721a4fa5fab9 to before 3884358a9286b17f389a72b1426fc4547c23c111 git
  • affected cef401de7be8c4e155c6746bfccf721a4fa5fab9 to before f84eca5817390257cef78013d0112481c503b4a3 git
Other versions: unaffected
Linux Linux
  • affected 3.9
  • unaffected before 3.9 semver
  • unaffected 5.10.257 to 5.10.*, inclusive semver
  • unaffected 5.15.208 to 5.15.*, inclusive semver
  • unaffected 6.1.174 to 6.1.*, inclusive semver
  • unaffected 6.6.141 to 6.6.*, inclusive semver
  • unaffected 6.12.91 to 6.12.*, inclusive semver
  • unaffected 6.18.33 to 6.18.*, inclusive semver
  • unaffected 7.0.10 to 7.0.*, inclusive semver
  • unaffected 7.1 to *, inclusive original_commit_for_fix
Other versions: affected
Identifiers
CVE-2026-46300
CNA
Linux
Weakness (CWE)
CWE-123 · CWE-456
Tags
Published
23 May 2026
Updated
29 Oct 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

ScoreRatingCVSSVectorSource
7.8 High 3.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CNA (Linux)Used for this record
7.8 High 3.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H ADP (redhat-SADP)
  • CISA KEV Listed since 28 Oct 2026: known to be exploited.
  • EPSS 0.16, the 96th percentile, on 6 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 23 May 2026. New records show when each source confirmed them.

Sources

References from the CNA

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.