CVE-2026-46300

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. Questo viola l'invariante su cui si basano i successivi scrittori in-place. In particolare, l'input ESP controlla skb_has_shared_frag() prima di decidere se una skb non clonata e non lineare può saltare skb_cow_data(). Se la ricezione TCP con coalescing ha spostato frammenti condivisi in una skb senza marcatore, ESP può rilevare skb_has_shared_frag() come falso e decifrare in-place su frammenti supportati dalla page cache. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.