Read the docs
TI-2026-34021 Aliases CVE-2026-46300GHSA-47jg-vqrv-5f8v

Linux kernel skb coalescing drops shared-frag marker

Priority CRITICAL 93Exploited in the wildCWE-456Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-787 and the CVSS impact.

Summary

The Linux kernel from 3.9 is affected. When skb_try_coalesce() transfers paged fragments, it drops the shared-fragment marker, so ESP input can decrypt in place over page-cache-backed frags (CWE-456). A local user with low privileges can exploit this, with high impact to confidentiality, integrity and availability. CISA lists it in KEV, added 2026-10-28.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.

Why it matters now

Exploitation Active In CISA KEV since 2026-10-28CISA due date 2026-10-31
EPSS 0.1613 96th percentileScored 2026-11-07
Fix Fixed Linux (Linux): 5.10.257, 5.15.208, 6.1.174 +5Red Hat: 32 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LinuxLinux3.9 and later5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10, 7.1Patch availableCNA
  • Linux VendorLinux Affected 3.9 and later Fixed in 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10, 7.1 Patch available CNA

CPE configurations NVD · 26

CPEVersionsRoleVendor
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*3.9 – 5.10.257; 5.11 to before 5.15.208; 5.16 to before 6.1.174; 6.2 to before 6.6.141; 6.7 to before 6.12.91; 6.13 to before 6.18.33; 6.19 to before 7.0.10VulnerableLinux
cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*7.1 rc1VulnerableLinux
cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*7.1 rc2VulnerableLinux
cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*7.1 rc3VulnerableLinux
cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*7.1 rc4VulnerableLinux
cpe:2.3:o:siemens:simatic_s7-1500_cpu_1518-4_pn\/dp_mfp_firmware:*:*:*:*:*:*:*:*3.1.5 – 3.1.6VulnerableSiemens
cpe:2.3:h:siemens:simatic_s7-1500_cpu_1518-4_pn\/dp_mfp:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*4.12 to before 4.12.91; 4.13 to before 4.13.67; 4.14 to before 4.14.68; 4.15 to before 4.15.65; 4.16 to before 4.16.63; 4.17 to before 4.17.55; 4.18 to before 4.18.43; 4.19 to before 4.19.33; 4.20 to before 4.20.24; 4.21 to before 4.21.17VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions 3.9 – 5.10.257; 5.11 to before 5.15.208; 5.16 to before 6.1.174; 6.2 to before 6.6.141; 6.7 to before 6.12.91; 6.13 to before 6.18.33; 6.19 to before 7.0.10 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* Versions 7.1 rc1 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* Versions 7.1 rc2 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* Versions 7.1 rc3 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* Versions 7.1 rc4 Vulnerable ·Linux
  • cpe:2.3:o:siemens:simatic_s7-1500_cpu_1518-4_pn\/dp_mfp_firmware:*:*:*:*:*:*:*:* Versions 3.1.5 – 3.1.6 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:simatic_s7-1500_cpu_1518-4_pn\/dp_mfp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:* Versions 4.12 to before 4.12.91; 4.13 to before 4.13.67; 4.14 to before 4.14.68; 4.15 to before 4.15.65; 4.16 to before 4.16.63; 4.17 to before 4.17.55; 4.18 to before 4.18.43; 4.19 to before 4.19.33; 4.20 to before 4.20.24; 4.21 to before 4.21.17 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
Show 16 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*9.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*10.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_aus:8.4:*:*:*:*:*:*:*8.4VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_aus:8.6:*:*:*:*:*:*:*8.6VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*8.4VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_eus:9.4:*:*:*:*:*:*:*9.4VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_eus:9.6:*:*:*:*:*:*:*9.6VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_eus:10.0:*:*:*:*:*:*:*10.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_tus:8.6:*:*:*:*:*:*:*8.6VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_tus:8.8:*:*:*:*:*:*:*8.8VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:*8.6VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.8:*:*:*:*:*:*:*8.8VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.0:*:*:*:*:*:*:*9.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.2:*:*:*:*:*:*:*9.2VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.4:*:*:*:*:*:*:*9.4VulnerableRed Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_aus:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_aus:8.6:*:*:*:*:*:*:* Versions 8.6 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:9.4:*:*:*:*:*:*:* Versions 9.4 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:9.6:*:*:*:*:*:*:* Versions 9.6 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_tus:8.6:*:*:*:*:*:*:* Versions 8.6 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_tus:8.8:*:*:*:*:*:*:* Versions 8.8 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:* Versions 8.6 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.8:*:*:*:*:*:*:* Versions 8.8 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.2:*:*:*:*:*:*:* Versions 9.2 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.4:*:*:*:*:*:*:* Versions 9.4 Vulnerable ·Red Hat

Remediation

Upgrade the Linux kernel to 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10 or 7.1, depending on the branch in use. Red Hat fixes it in advisories including RHSA-2026:34098, RHSA-2026:28887, RHSA-2026:33486, RHSA-2026:25044 and RHSA-2026:23240. CISA requires U.S. federal agencies to fix it by 2026-10-31.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA Linux (Linux) Fixed in 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10, 7.1

Red Hat 32 advisories

  • RHSA-2026:34098 Released 2026-07-09 · Red Hat rating Critical
    OpenShift Container Platform 4.17.55 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 rhcos-aarch64-417.94.202606250942-0, rhcos-ppc64le-417.94.202606250942-0, rhcos-s390x-417.94.202606250942-0 +1
  • RHSA-2026:28887 Released 2026-07-01 · Red Hat rating Critical
    OpenShift Container Platform 4.14.68 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 rhcos-aarch64-414.92.202606231112-0, rhcos-ppc64le-414.92.202606231112-0, rhcos-s390x-414.92.202606231112-0 +1
  • RHSA-2026:33486 Released 2026-06-30 · Red Hat rating Critical
    kernel security, bug fix, and enhancement update
    • NVIDIA for RHEL 10 kernel-6.12.0-231.12.el10nv, kernel-64k-6.12.0-231.12.el10nv, kernel-64k-core-6.12.0-231.12.el10nv +32
Show 29 more Red Hat advisories
  • RHSA-2026:25044 Released 2026-06-18 · Red Hat rating Important
    OpenShift Container Platform 4.16.64 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 rhcos-aarch64-416.94.202606051757-0, rhcos-ppc64le-416.94.202606051757-0, rhcos-s390x-416.94.202606051757-0 +1
  • RHSA-2026:23240 Released 2026-06-11 · Red Hat rating Important
    OpenShift Container Platform 4.21.19 bug fix and security update
    • Red Hat OpenShift Container Platform 4.21 rhcos-aarch64-4.21.9.6.202606030721-0, rhcos-ppc64le-4.21.9.6.202606030721-0, rhcos-s390x-4.21.9.6.202606030721-0 +1
  • RHSA-2026:23233 Released 2026-06-11 · Red Hat rating Important
    OpenShift Container Platform 4.15.65 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 rhcos-aarch64-415.92.202606030318-0, rhcos-ppc64le-415.92.202606030318-0, rhcos-s390x-415.92.202606030318-0 +1
  • RHSA-2026:23245 Released 2026-06-10 · Red Hat rating Important
    OpenShift Container Platform 4.19.33 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 rhcos-aarch64-4.19.9.6.202606031700-0, rhcos-ppc64le-4.19.9.6.202606031700-0, rhcos-s390x-4.19.9.6.202606031700-0 +1
  • RHSA-2026:24814 Released 2026-06-09 · Red Hat rating Important
    kpatch-patch security update
    • Red Hat Enterprise Linux BaseOS E4S (v.9.4) kpatch-patch-5_14_0-427_100_1-1-5.el9_4, kpatch-patch-5_14_0-427_113_1-1-3.el9_4, kpatch-patch-5_14_0-427_55_1-1-15.el9_4 +2
  • RHSA-2026:23469 Released 2026-06-04 · Red Hat rating Important
    kpatch-patch-5_14_0-284_104_1, kpatch-patch-5_14_0-284_117_1, kpatch-patch-5_14_0-284_134_1, kpatch-patch-5_14_0-284_148_1, and kpatch-patch-5_14_0-284_158_1 security update
    • Red Hat Enterprise Linux BaseOS E4S (v.9.2) kpatch-patch-5_14_0-284_104_1-1-16.el9_2, kpatch-patch-5_14_0-284_117_1-1-13.el9_2, kpatch-patch-5_14_0-284_134_1-1-7.el9_2 +2
  • RHSA-2026:23468 Released 2026-06-04 · Red Hat rating Important
    kpatch-patch-5_14_0-570_17_1, kpatch-patch-5_14_0-570_39_1, kpatch-patch-5_14_0-570_66_1, and kpatch-patch-5_14_0-570_94_1 security update
    • Red Hat Enterprise Linux BaseOS EUS (v.9.6) kpatch-patch-5_14_0-570_17_1-1-15.el9_6, kpatch-patch-5_14_0-570_39_1-1-6.el9_6, kpatch-patch-5_14_0-570_66_1-1-5.el9_6 +1
  • RHSA-2026:23470 Released 2026-06-04 · Red Hat rating Important
    kpatch-patch-4_18_0-553_109_1, kpatch-patch-4_18_0-553_40_1, kpatch-patch-4_18_0-553_53_1, kpatch-patch-4_18_0-553_72_1, and kpatch-patch-4_18_0-553_85_1 security update
    • Red Hat Enterprise Linux BaseOS (v. 8) kpatch-patch-4_18_0-553_109_1-1-3.el8_10, kpatch-patch-4_18_0-553_40_1-1-12.el8_10, kpatch-patch-4_18_0-553_53_1-1-10.el8_10 +2
  • RHSA-2026:23471 Released 2026-06-04 · Red Hat rating Important
    kpatch-patch-4_18_0-477_107_1, kpatch-patch-4_18_0-477_120_1, kpatch-patch-4_18_0-477_130_1, kpatch-patch-4_18_0-477_89_1, and kpatch-patch-4_18_0-477_97_1 security update
    • Red Hat Enterprise Linux BaseOS E4S (v.8.8) kpatch-patch-4_18_0-477_107_1-1-6.el8_8, kpatch-patch-4_18_0-477_120_1-1-5.el8_8, kpatch-patch-4_18_0-477_130_1-1-3.el8_8 +2
  • RHSA-2026:21695 Released 2026-06-04 · Red Hat rating Important
    OpenShift Container Platform 4.12.91 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 rhcos-x86_64-412.86.202605271418-0
  • RHSA-2026:21690 Released 2026-06-04 · Red Hat rating Important
    OpenShift Container Platform 4.13.67 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 rhcos-x86_64-413.92.202605271328-0
  • RHSA-2026:21702 Released 2026-06-03 · Red Hat rating Important
    OpenShift Container Platform 4.20.24 bug fix and security update
    • Red Hat OpenShift Container Platform 4.20 rhcos-aarch64-4.20.9.6.202605270908-0, rhcos-ppc64le-4.20.9.6.202605270908-0, rhcos-s390x-4.20.9.6.202605270908-0 +1
  • RHSA-2026:21656 Released 2026-06-03 · Red Hat rating Important
    OpenShift Container Platform 4.18.43 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 rhcos-aarch64-418.94.202605260517-0, rhcos-ppc64le-418.94.202605260517-0, rhcos-s390x-418.94.202605260517-0 +1
  • RHSA-2026:20087 Released 2026-05-29 · Red Hat rating Important
    OpenShift Container Platform 4.16.63 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 rhcos-aarch64-416.94.202605200242-0, rhcos-ppc64le-416.94.202605200242-0, rhcos-s390x-416.94.202605200242-0 +1
  • RHSA-2026:20593 Released 2026-05-26 · Red Hat rating Important
    kernel security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) kernel-64k-debug-devel-5.14.0-284.172.1.el9_2, kernel-64k-debug-devel-matched-5.14.0-284.172.1.el9_2, kernel-64k-devel-5.14.0-284.172.1.el9_2 +10
    • Red Hat Enterprise Linux BaseOS E4S (v.9.2) bpftool-7.0.0-284.172.1.el9_2, kernel-5.14.0-284.172.1.el9_2, kernel-64k-5.14.0-284.172.1.el9_2 +29
  • RHSA-2026:20299 Released 2026-05-21 · Red Hat rating Important
    kernel security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) kernel-64k-debug-devel-6.12.0-55.75.1.el10_0, kernel-64k-debug-devel-matched-6.12.0-55.75.1.el10_0, kernel-64k-devel-6.12.0-55.75.1.el10_0 +12
    • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) kernel-6.12.0-55.75.1.el10_0, kernel-64k-6.12.0-55.75.1.el10_0, kernel-64k-core-6.12.0-55.75.1.el10_0 +28
    • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) kernel-tools-libs-devel-6.12.0-55.75.1.el10_0, libperf-6.12.0-55.75.1.el10_0
    • Red Hat Enterprise Linux Real Time EUS (v. 10.0) kernel-rt-6.12.0-55.75.1.el10_0, kernel-rt-64k-6.12.0-55.75.1.el10_0, kernel-rt-64k-core-6.12.0-55.75.1.el10_0 +21
    • Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0) kernel-rt-6.12.0-55.75.1.el10_0, kernel-rt-core-6.12.0-55.75.1.el10_0, kernel-rt-debug-6.12.0-55.75.1.el10_0 +11
  • RHSA-2026:20129 Released 2026-05-21 · Red Hat rating Important
    kernel security update
    • Red Hat CodeReady Linux Builder EUS (v.9.6) kernel-tools-libs-devel-5.14.0-570.116.1.el9_6, libperf-5.14.0-570.116.1.el9_6
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) kernel-64k-debug-devel-5.14.0-570.116.1.el9_6, kernel-64k-debug-devel-matched-5.14.0-570.116.1.el9_6, kernel-64k-devel-5.14.0-570.116.1.el9_6 +12
    • Red Hat Enterprise Linux BaseOS EUS (v.9.6) kernel-5.14.0-570.116.1.el9_6, kernel-64k-5.14.0-570.116.1.el9_6, kernel-64k-core-5.14.0-570.116.1.el9_6 +28
    • Red Hat Enterprise Linux Real Time EUS (v.9.6) kernel-rt-5.14.0-570.116.1.el9_6, kernel-rt-64k-5.14.0-570.116.1.el9_6, kernel-rt-64k-core-5.14.0-570.116.1.el9_6 +21
    • Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6) kernel-rt-5.14.0-570.116.1.el9_6, kernel-rt-core-5.14.0-570.116.1.el9_6, kernel-rt-debug-5.14.0-570.116.1.el9_6 +11
  • RHSA-2026:20054 Released 2026-05-21 · Red Hat rating Important
    kernel security update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) kernel-tools-libs-devel-5.14.0-427.126.1.el9_4, libperf-5.14.0-427.126.1.el9_4
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) kernel-64k-debug-devel-5.14.0-427.126.1.el9_4, kernel-64k-debug-devel-matched-5.14.0-427.126.1.el9_4, kernel-64k-devel-5.14.0-427.126.1.el9_4 +11
    • Red Hat Enterprise Linux BaseOS EUS (v.9.4) bpftool-7.3.0-427.126.1.el9_4, kernel-5.14.0-427.126.1.el9_4, kernel-64k-5.14.0-427.126.1.el9_4 +29
    • Red Hat Enterprise Linux Real Time EUS (v.9.4) kernel-rt-5.14.0-427.126.1.el9_4, kernel-rt-core-5.14.0-427.126.1.el9_4, kernel-rt-debug-5.14.0-427.126.1.el9_4 +9
    • Red Hat Enterprise Linux Real Time for NFV EUS (v.9.4) kernel-rt-5.14.0-427.126.1.el9_4, kernel-rt-core-5.14.0-427.126.1.el9_4, kernel-rt-debug-5.14.0-427.126.1.el9_4 +11
  • RHSA-2026:20130 Released 2026-05-21 · Red Hat rating Important
    kernel security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.4) bpftool-4.18.0-305.192.1.el8_4, kernel-4.18.0-305.192.1.el8_4, kernel-abi-stablelists-4.18.0-305.192.1.el8_4 +14
    • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) bpftool-4.18.0-305.192.1.el8_4, kernel-4.18.0-305.192.1.el8_4, kernel-abi-stablelists-4.18.0-305.192.1.el8_4 +14
  • RHSA-2026:20051 Released 2026-05-21 · Red Hat rating Important
    kernel security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.6) bpftool-4.18.0-372.193.1.el8_6, kernel-4.18.0-372.193.1.el8_6, kernel-abi-stablelists-4.18.0-372.193.1.el8_6 +14
    • Red Hat Enterprise Linux BaseOS E4S (v.8.6) bpftool-4.18.0-372.193.1.el8_6, kernel-4.18.0-372.193.1.el8_6, kernel-abi-stablelists-4.18.0-372.193.1.el8_6 +19
    • Red Hat Enterprise Linux BaseOS TUS (v.8.6) bpftool-4.18.0-372.193.1.el8_6, kernel-4.18.0-372.193.1.el8_6, kernel-abi-stablelists-4.18.0-372.193.1.el8_6 +14
  • RHSA-2026:19875 Released 2026-05-20 · Red Hat rating Important
    kernel-rt security update
    • Red Hat Enterprise Linux Real Time E4S (v.9.2) kernel-rt-5.14.0-284.172.1.rt14.457.el9_2, kernel-rt-core-5.14.0-284.172.1.rt14.457.el9_2, kernel-rt-debug-5.14.0-284.172.1.rt14.457.el9_2 +9
    • Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2) kernel-rt-5.14.0-284.172.1.rt14.457.el9_2, kernel-rt-core-5.14.0-284.172.1.rt14.457.el9_2, kernel-rt-debug-5.14.0-284.172.1.rt14.457.el9_2 +11
  • RHSA-2026:19711 Released 2026-05-20 · Red Hat rating Important
    kernel-rt security update
    • Red Hat Enterprise Linux NFV E4S (v.9.0) kernel-rt-5.14.0-70.180.1.rt21.252.el9_0, kernel-rt-core-5.14.0-70.180.1.rt21.252.el9_0, kernel-rt-debug-5.14.0-70.180.1.rt21.252.el9_0 +9
    • Red Hat Enterprise Linux Real Time E4S (v.9.0) kernel-rt-5.14.0-70.180.1.rt21.252.el9_0, kernel-rt-core-5.14.0-70.180.1.rt21.252.el9_0, kernel-rt-debug-5.14.0-70.180.1.rt21.252.el9_0 +7
  • RHSA-2026:19705 Released 2026-05-20 · Red Hat rating Important
    kernel security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) kernel-debug-devel-5.14.0-70.180.1.el9_0, kernel-debug-devel-matched-5.14.0-70.180.1.el9_0, kernel-devel-5.14.0-70.180.1.el9_0 +5
    • Red Hat Enterprise Linux BaseOS E4S (v.9.0) bpftool-5.14.0-70.180.1.el9_0, kernel-5.14.0-70.180.1.el9_0, kernel-abi-stablelists-5.14.0-70.180.1.el9_0 +14
  • RHSA-2026:19568 Released 2026-05-20 · Red Hat rating Important
    kernel security update
    • Red Hat Enterprise Linux AppStream (v. 9) kernel-64k-debug-devel-5.14.0-687.10.1.el9_8, kernel-64k-debug-devel-matched-5.14.0-687.10.1.el9_8, kernel-64k-devel-5.14.0-687.10.1.el9_8 +12
    • Red Hat Enterprise Linux BaseOS (v. 9) kernel-5.14.0-687.10.1.el9_8, kernel-64k-5.14.0-687.10.1.el9_8, kernel-64k-core-5.14.0-687.10.1.el9_8 +28
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) kernel-tools-libs-devel-5.14.0-687.10.1.el9_8, libperf-5.14.0-687.10.1.el9_8
    • Red Hat Enterprise Linux Real Time (v. 9) kernel-rt-5.14.0-687.10.1.el9_8, kernel-rt-64k-5.14.0-687.10.1.el9_8, kernel-rt-64k-core-5.14.0-687.10.1.el9_8 +21
    • Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt-5.14.0-687.10.1.el9_8, kernel-rt-core-5.14.0-687.10.1.el9_8, kernel-rt-debug-5.14.0-687.10.1.el9_8 +9
  • RHSA-2026:19666 Released 2026-05-20 · Red Hat rating Important
    kernel security update
    • Red Hat Enterprise Linux BaseOS (v. 8) bpftool-4.18.0-553.125.1.el8_10, kernel-4.18.0-553.125.1.el8_10, kernel-abi-stablelists-4.18.0-553.125.1.el8_10 +19
    • Red Hat Enterprise Linux CRB (v. 8) kernel-tools-libs-devel-4.18.0-553.125.1.el8_10
  • RHSA-2026:19664 Released 2026-05-20 · Red Hat rating Important
    kernel-rt security update
    • Red Hat Enterprise Linux NFV (v. 8) kernel-rt-4.18.0-553.125.1.rt7.466.el8_10, kernel-rt-core-4.18.0-553.125.1.rt7.466.el8_10, kernel-rt-debug-4.18.0-553.125.1.rt7.466.el8_10 +9
    • Red Hat Enterprise Linux RT (v. 8) kernel-rt-4.18.0-553.125.1.rt7.466.el8_10, kernel-rt-core-4.18.0-553.125.1.rt7.466.el8_10, kernel-rt-debug-4.18.0-553.125.1.rt7.466.el8_10 +7
  • RHSA-2026:19569 Released 2026-05-20 · Red Hat rating Important
    kernel security update
    • Red Hat Enterprise Linux AppStream (v. 10) kernel-64k-debug-devel-6.12.0-211.16.1.el10_2, kernel-64k-debug-devel-matched-6.12.0-211.16.1.el10_2, kernel-64k-devel-6.12.0-211.16.1.el10_2 +12
    • Red Hat Enterprise Linux BaseOS (v. 10) kernel-6.12.0-211.16.1.el10_2, kernel-64k-6.12.0-211.16.1.el10_2, kernel-64k-core-6.12.0-211.16.1.el10_2 +29
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) kernel-tools-libs-devel-6.12.0-211.16.1.el10_2, libperf-6.12.0-211.16.1.el10_2
    • Red Hat Enterprise Linux Real Time (v. 10) kernel-rt-6.12.0-211.16.1.el10_2, kernel-rt-64k-6.12.0-211.16.1.el10_2, kernel-rt-64k-core-6.12.0-211.16.1.el10_2 +21
    • Red Hat Enterprise Linux Real Time for NFV (v. 10) kernel-rt-6.12.0-211.16.1.el10_2, kernel-rt-core-6.12.0-211.16.1.el10_2, kernel-rt-debug-6.12.0-211.16.1.el10_2 +9
  • RHSA-2026:19540 Released 2026-05-20 · Red Hat rating Important
    kernel security update
    • NVIDIA for RHEL 10 kernel-6.12.0-211.8.el10nv, kernel-64k-6.12.0-211.8.el10nv, kernel-64k-core-6.12.0-211.8.el10nv +32
  • RHSA-2026:19521 Released 2026-05-20 · Red Hat rating Important
    kernel security update
    • Red Hat Enterprise Linux BaseOS E4S (v.8.8) bpftool-4.18.0-477.143.1.el8_8, kernel-4.18.0-477.143.1.el8_8, kernel-abi-stablelists-4.18.0-477.143.1.el8_8 +14
    • Red Hat Enterprise Linux BaseOS TUS (v.8.8) bpftool-4.18.0-477.143.1.el8_8, kernel-4.18.0-477.143.1.el8_8, kernel-abi-stablelists-4.18.0-477.143.1.el8_8 +14

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
NVIDIA for RHEL 10Fixed RHSA-2026:19540, RHSA-2026:33486
Red Hat CodeReady Linux Builder EUS (v.9.4)Fixed RHSA-2026:20054
Red Hat CodeReady Linux Builder EUS (v.9.6)Fixed RHSA-2026:20129
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:19569
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:19568
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2026:19705
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:20593
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:20299
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2026:20054
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:20129
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2026:19569
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2026:19666, RHSA-2026:23470
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2026:19568
Red Hat Enterprise Linux BaseOS AUS (v.8.4)Fixed RHSA-2026:20130
Red Hat Enterprise Linux BaseOS AUS (v.8.6)Fixed RHSA-2026:20051
Red Hat Enterprise Linux BaseOS E4S (v.8.6)Fixed RHSA-2026:20051
Red Hat Enterprise Linux BaseOS E4S (v.8.8)Fixed RHSA-2026:19521, RHSA-2026:23471
Red Hat Enterprise Linux BaseOS E4S (v.9.0)Fixed RHSA-2026:19705
Red Hat Enterprise Linux BaseOS E4S (v.9.2)Fixed RHSA-2026:20593, RHSA-2026:23469
Red Hat Enterprise Linux BaseOS E4S (v.9.4)Fixed RHSA-2026:24814
Red Hat Enterprise Linux BaseOS EUS (v. 10.0)Fixed RHSA-2026:20299
Red Hat Enterprise Linux BaseOS EUS (v.9.4)Fixed RHSA-2026:20054
Red Hat Enterprise Linux BaseOS EUS (v.9.6)Fixed RHSA-2026:20129, RHSA-2026:23468
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)Fixed RHSA-2026:20130
Red Hat Enterprise Linux BaseOS TUS (v.8.6)Fixed RHSA-2026:20051
Red Hat Enterprise Linux BaseOS TUS (v.8.8)Fixed RHSA-2026:19521
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2026:19666
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:19569
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:19568
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)Fixed RHSA-2026:20299
Red Hat Enterprise Linux NFV (v. 8)Fixed RHSA-2026:19664
Red Hat Enterprise Linux NFV E4S (v.9.0)Fixed RHSA-2026:19711
Red Hat Enterprise Linux RT (v. 8)Fixed RHSA-2026:19664
Red Hat Enterprise Linux Real Time (v. 10)Fixed RHSA-2026:19569
Red Hat Enterprise Linux Real Time (v. 9)Fixed RHSA-2026:19568
Red Hat Enterprise Linux Real Time E4S (v.9.0)Fixed RHSA-2026:19711
Red Hat Enterprise Linux Real Time E4S (v.9.2)Fixed RHSA-2026:19875
Red Hat Enterprise Linux Real Time EUS (v. 10.0)Fixed RHSA-2026:20299
Red Hat Enterprise Linux Real Time EUS (v.9.4)Fixed RHSA-2026:20054
Red Hat Enterprise Linux Real Time EUS (v.9.6)Fixed RHSA-2026:20129
Red Hat Enterprise Linux Real Time for NFV (v. 10)Fixed RHSA-2026:19569
Red Hat Enterprise Linux Real Time for NFV (v. 9)Fixed RHSA-2026:19568
Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)Fixed RHSA-2026:19875
Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)Fixed RHSA-2026:20299
Red Hat Enterprise Linux Real Time for NFV EUS (v.9.4)Fixed RHSA-2026:20054
Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)Fixed RHSA-2026:20129
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2026:21695
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2026:21690
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2026:28887
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2026:23233
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2026:20087, RHSA-2026:25044
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2026:34098
Red Hat OpenShift Container Platform 4.18Fixed RHSA-2026:21656
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2026:23245
Red Hat OpenShift Container Platform 4.20Fixed RHSA-2026:21702
Red Hat OpenShift Container Platform 4.21Fixed RHSA-2026:23240
Not affected: 2 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-46300
  2. 2026-10-03 Alias added: GHSA-47jg-vqrv-5f8v
  3. 2026-10-16 CISA SSVC decision points changed
  4. 2026-10-16 Priority changed: LOW → MEDIUM
  5. 2026-10-19 Weakness changed · CISA ADP
  6. 2026-10-25 EPSS moved to the 95th–99th percentile
  7. 2026-10-28 Added to CISA KEV
  8. 2026-10-28 Priority changed: MEDIUM → CRITICAL
  9. 2026-10-28 CISA SSVC decision points changed
  10. 2026-10-29 CISA SSVC decision points changed

References

Patch 8

Advisory 38

  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
  • TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
  • TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
  • TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
  • TI-2021-05514 Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE KEVCVSS 3.1HIGH 8.3
See all 15278 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences