CISA KEV: Linux kernel CVE-2026-46300 due October 31
Original title: CISA KEV: Linux Kernel Missing Initialization of a Variable Vulnerability — Linux Kernel (CVE-2026-46300)
The flaw can alter page-cache data and, chained with two other CVEs, implant PHP webshells that run as root.
CISA's KEV entry says the Linux kernel fails to initialize a variable, so socket-buffer coalescing can drop the shared-fragment marker and let ESP input processing decrypt shared fragments in place. CISA says it can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root. Required action is due 2026-10-31 under BOD 26-04, including forensics triage. Known ransomware campaign use is listed as unknown.
Unconfirmed: CISA lists known ransomware campaign use as unknown.
- The defect is missing initialization during socket buffer coalescing.
- Chained flaws are CVE-2026-109618 and CVE-2026-109619.
- Agencies must follow BOD 26-04 forensics triage requirements.
- If mitigations are unavailable, discontinue use of the product.
Impact: In-place decryption of shared fragments; root via chained webshells
| Product | Affected |
|---|---|
| Linux Kernel | — |
- 1.Apply vendor mitigations by 2026-10-31 and follow BOD 26-04.
- 2.Perform CISA forensics triage if the asset was exposed before patching.
- 3.Discontinue use if mitigations are unavailable.
- Products
- Linux Kernel
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-46300 | Shared-frag marker loss in Linux kernel skb coalescing (LPE) | 7.8 | 16% | KEVPoC | KEV |
From the original article
1 min read at cisa.govLinux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place.
cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.