ZeroDayAlert

CVE-2026-46300: Linux Kernel Missing Initialization of a Variable Vulnerability

Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.

Linux Kernel Added to KEV 2026-10-28 Federal due 2026-10-31 Known ransomware use

Required action — quoted from CISA

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Where this comes from. The identifier, product, dates and required action above are copied verbatim from the CISA Known Exploited Vulnerabilities catalog. The action plan below is written by an AI agent from that record and published automatically. AssurePort has not independently tested this vulnerability and makes no claim about whether any specific system is affected.

Who is affected

Linux systems running affected versions of the kernel are at risk. The vulnerability centres on memory initialisation during socket buffer operations, affecting how encrypted data in shared page-cache regions is handled. The record does not specify which kernel versions are vulnerable, nor does it detail whether this affects all architectures or only specific deployment contexts.

How to check whether this touches you

  • Inventory Linux systems in your environment and note which are internet-facing or accessible from untrusted networks.
  • Establish whether each system's kernel handles encrypted traffic (ESP/IPsec) or runs services that coalesce socket buffers — this determines exposure likelihood.
  • Query running kernel version via uname -r and cross-reference against vendor security advisories; note that backported fixes may exist in earlier version strings.
  • If you run managed cloud instances, check your cloud provider's patch status and any inherited mitigations they have applied.
  • Identify systems running PHP or other web applications, as the record indicates PHP webshell implantation is a plausible chain attack.

What to do

  1. Consult Linux vendor (Red Hat, Canonical, SUSE, etc.) security advisories for CVE-2026-46300 and apply patches according to your vendor's release schedule and CISA BOD 26-04 guidance.
  2. If patches are not yet available, restrict network access to affected systems: disable unnecessary services, apply firewall rules to limit ESP/IPsec traffic to trusted sources only, and isolate web-facing instances where feasible.
  3. Enable logging of kernel memory errors, page-cache operations, and ESP decryption failures if your kernel supports such instrumentation; retain logs for at least 90 days.
  4. Escalate to your change management and incident response teams immediately if the system runs production web applications or handles sensitive encrypted data.
  5. Test patches in a non-production environment before rolling out to production, as kernel updates require system restart.

If you find you were exposed

Exploitation would likely predate public disclosure, so search system logs and auth records for unauthorised PHP file creation, unexpected root-level process execution, and anomalous network connections prior to the CISA publication date (2026-10-28). Examine web application directories and temporary directories for newly created files with timestamps preceding your patch deployment. Confirm the findings with your security team and consider full forensic acquisition of affected systems if you suspect compromise.

Get these the morning they land.

One email, only when a vulnerability is newly confirmed as exploited — the CISA record plus our action plan. No more than one a day, and nothing on quiet days.

Knowing it exists is not the same as knowing you are exposed.

This page can tell you that CVE-2026-46300 is being exploited. It cannot tell you whether Kernel is running somewhere of yours that is reachable. That question is what a scan answers.

Check your own surface →