Linux kernel CVE-2026-46300 added to CISA KEV, exploited
Update (October 29, 2026)
CISA added VMware ESX flaw CVE-2026-41709 to KEV after Warp Panda used it to hide activity. Check your builds, patch and review ESX audit logs.
At a glance
| Severity | HIGH |
|---|---|
| CVSS | CVE-2026-46300: 7.8 |
| EPSS (30-day exploit probability) | CVE-2026-46300: 10.2% |
| In CISA KEV (exploited) | Yes, due 2026-10-31 |
| Vendor | Linux |
| CVE IDs | CVE-2026-46300 |
Primary-source details
- CVE-2026-46300: CVSS 7.8 (High), per NVD; fixed in linux linux kernel: 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10 (NVD); added to the CISA KEV catalog on 2026-10-28, remediation due 2026-10-31; vendor advisory (listed by NVD).
CISA added CVE-2026-46300, a Linux kernel flaw in network buffer handling, to its Known Exploited Vulnerabilities catalog on 28 October 2026, according to the CISA KEV catalog. The Linux kernel vulnerability is rated CVSS 7.8 (High), is confirmed as exploited, and federal agencies have until 31 October 2026 to apply mitigations.
CISA also notes that the flaw can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.
What happened
CISA describes the issue as a missing initialization of a variable in the Linux kernel. In practice the kernel loses a marker (SKBFL_SHARED_FRAG) that tells later code a network buffer points at memory it does not exclusively own, such as page-cache-backed data. The NVD record explains the mechanism: when skb_try_coalesce() moves paged fragments from one socket buffer to another, the marker was not carried over.
That matters because the IPsec ESP input path checks the marker before deciding whether it can decrypt a packet in place. With the marker lost during TCP receive coalescing, ESP can decrypt directly over page-cache-backed fragments. The result, per CISA, is unintended modification of page-cache-backed data. NVD maps the weakness to CWE-123, CWE-456 and CWE-787.
The NVD entry was published on 23 May 2026. CISA’s catalog addition on 28 October is the signal that exploitation has been observed. CISA lists known ransomware campaign use as unknown.
Am I affected?
NVD lists these kernel ranges as affected:
- 3.9 up to and including 5.10.257
- 5.11 up to (not including) 5.15.208
- 5.16 up to (not including) 6.1.174
- 6.2 up to (not including) 6.6.141
- 6.7 up to (not including) 6.12.91
- 6.13 up to (not including) 6.18.33
- 6.19 up to (not including) 7.0.10
- 7.1
Distribution kernels often backport fixes without changing the upstream version number, so check your vendor’s security notice for this CVE rather than relying on the version string alone. The attack vector is local with low privileges and no user interaction, so multi-tenant hosts, shared build servers, container hosts and any system where untrusted users or workloads can run code deserve attention first. Systems using IPsec ESP are the ones named in the NVD description.
Technical details
- CVSS 3.1: 7.8 High, vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CISA KEV: added 2026-10-28, due 2026-10-31
- EPSS: 0.10192 for CVE-2026-46300
- Ransomware use: unknown per CISA
A local, low-privilege flaw does not look alarming by score alone. The chaining note changes that: CISA says it can be combined with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root. A foothold through a web application could therefore become full control of the host.
Why this matters
Analysis, not new reporting. The EPSS value is modest, but a KEV entry means exploitation has been seen, and the three-day deadline reflects that. Servers that run PHP applications alongside a vulnerable kernel are the realistic target: an attacker who lands a web-level foothold can then try to escalate to root. Treat any internet-facing Linux host in the affected ranges as a priority, and patch within hours rather than the next maintenance window if you cannot rule out untrusted local code.
Detection and hunting ideas
The candidate facts contain no published indicators of compromise, so there are no hashes, domains or addresses to block. Reasonable hunting steps that follow from the description:
- Look for PHP files that appeared recently in web roots or upload directories, especially ones not part of a deployment.
- Review web server processes spawning shells or running as root.
- Check for unexpected changes to files that are normally read-only and served from page cache.
- Where ESP/IPsec is in use, review hosts for unexplained privilege changes after web-facing incidents.
What to do
- Identify Linux hosts and containers running kernels in the ranges above, starting with internet-facing and multi-tenant systems.
- Update to a fixed kernel. NVD lists the fixed upstream releases as 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33 and 7.0.10, depending on your branch. For distribution kernels, install the vendor’s patched package and reboot.
- If you cannot patch immediately, apply the vendor’s mitigations as CISA requires, and reduce exposure by restricting who can run local code on the host.
- Also assess the two chained CVEs, CVE-2026-109618 and CVE-2026-109619, since the chain is what gives an attacker root.
- Hunt for webshells and unexpected root activity on hosts that were exposed before patching, and treat any hit as a full compromise.
- US federal agencies must meet the 31 October 2026 KEV due date; other organisations should use it as a benchmark.
