CISA KEV: Linux Kernel CVE-2026-46300 (CVSS 3.1 7.8 HIGH) - Kernel Missing Initialization of a Variable Vulnerability

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.

Back to the daily feed

KEV

criticalPublished October 29, 2026 at 1:00 PM UTC

Blue Goat Risk Score

Blue Goat Cyber MedTech rubric v1.0 · methodology

6.1

of 10

notable

CVSS technical

40% · +3.1

3.1 base 7.8 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Patient safety

35% · +0.7

No direct patient impact inferred

Exploit maturity

15% · +1.5

On CISA KEV (in-the-wild)

MedTech exposure

10% · +0.8

8/10 network-reachable signals

How we got to 6.1

1
CVSS technical severity (40%)
Industry-standard exploitability + impact score. We prefer CVSS 4.0 and fall back to 3.1 per the FDA's Feb 2026 premarket cybersecurity guidance. Missing CVSS scores get a neutral 4.0 so unknown vulns are not over- or under-rated.
3.1 base 7.8 × 40% = +3.12
2
Patient safety impact (35%)
What happens to a patient if this vuln is exploited on a connected device. Auto-inferred from headline, dek, tags, and device class against a curated MedTech keyword library (pacemaker, infusion pump, EHR, PACS, etc.).
No direct patient impact inferred → 2 × 35% = +0.70
3
Exploit maturity (15%)
Is anyone actually using this in attacks? KEV listing > weaponized exploit > public PoC > none. KEV alone forces tier=critical regardless of CVSS.
On CISA KEV (in-the-wild) → 10 × 15% = +1.50
4
MedTech exposure (10%)
How likely this affects clinical operations: presence in our MedTech feed (+4 baseline), network-reachable signals (+3), known device-class tags (+2), identified MedTech vendor (+1).
Exposure 8/10 × 10% = +0.80

Tier cutoffs: Critical ≥ 8.5 · High 7.0–8.4 · Notable 4.0–6.9 · Info < 4.0. Full methodology, weights, and changelog at /goatfeed/risk-rubric.

Other items reviewed by the Blue Goat team.

Citations

#kev #cve #linux

CISA KEV: Linux Kernel CVE-2026-46300 (CVSS 3.1 7.8 HIGH) - Kernel Missing Initialization of a Variable Vulnerability

How we got to 6.1

Related Goat Feed analysis

Talk to Blue Goat Cyber