CVE-2026-46300

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: skbuff: preserve shared-frag marker during coalescing<br /> <br /> skb_try_coalesce() can attach paged frags from @from to @to. If @from<br /> has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same<br /> externally-owned or page-cache-backed frags, but the shared-frag marker<br /> is currently lost.<br /> <br /> That breaks the invariant relied on by later in-place writers. In<br /> particular, ESP input checks skb_has_shared_frag() before deciding<br /> whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP<br /> receive coalescing has moved shared frags into an unmarked skb, ESP can<br /> see skb_has_shared_frag() as false and decrypt in place over page-cache<br /> backed frags.<br /> <br /> Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged<br /> frags. The tailroom copy path does not need the marker because it copies<br /> bytes into @to&amp;#39;s linear data rather than transferring frag descriptors.