CISA says attackers exploit Linux kernel flaw CVE-2026-46300
Original title: CISA Warns of Linux Kernel Missing Initialization Vulnerability Exploited in Attacks
Federal agencies face an October 31 deadline; CISA says the bug is chained to plant PHP webshells and run as root.
CISA added CVE-2026-46300 to its Known Exploited Vulnerabilities catalog on October 28 and set an October 31 remediation deadline with forensic triage under Binding Operational Directive 26-04. The missing-initialization bug in skb_try_coalesce() can drop the SKBFL_SHARED_FRAG marker so ESP processing changes page-cache data in place. CISA says attackers chain it with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root. The CVSS score is 7.8 for a local, low-privilege attack.
Unconfirmed: It remains unknown whether the vulnerability has been used in ransomware campaigns.
- Fixed releases include Linux 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, and 7.0.10.
- Linux 7.1 is listed as unaffected.
- Whether the flaw has been used in ransomware is unknown.
- The kernel bug alone is not an unauthenticated remote takeover.
Impact: Root commands after chaining flaws to plant PHP webshells
| Product | Affected | Fixed in |
|---|---|---|
| Linux kernel | — | 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10 |
- 1.Install the distribution or vendor-approved kernel update
- 2.Meet the October 31 remediation and forensic-triage deadline where BOD 26-04 applies
- 3.Stop using the product if no mitigation is available
- Products
- Linux kernel
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-46300 | Shared-frag marker loss in Linux kernel skb coalescing (LPE) | 7.8 | 16% | KEVPoC | KEV |
From the original article
2 min read at cybersecuritynews.com
The U. S. Cybersecurity and Infrastructure Security Agency has warned that attackers are exploiting a Linux kernel vulnerability (CVE-2026-46300) that can help them gain control of affected systems.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.