CISA has added CVE-2026-46300, a Linux kernel flaw that can let ESP input processing decrypt page-cache-backed data in place, to its Known Exploited Vulnerabilities (KEV) catalog, with a remediation deadline of October 31, 2026.
What Is It
CVE-2026-46300 is a missing variable initialization flaw (CWE-456) in the kernel's socket buffer code (net/core/skbuff.c). When skb_try_coalesce() moves paged fragments from one skb to another, it drops the SKBFL_SHARED_FRAG marker. The resulting skb can still hold externally-owned or page-cache-backed fragments, but nothing marks them as shared anymore.
That breaks an invariant that later in-place writers depend on. ESP input calls skb_has_shared_frag() to decide whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared fragments into an unmarked skb, ESP sees no shared fragments and decrypts in place over page-cache-backed data. This can modify page-cache-backed data in ways nobody intended.
NVD scores it 7.8 HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). NVD's analysis is still marked "Undergoing Analysis."
Why It Matters
CISA added the flaw to KEV on 2026-10-28, which confirms active exploitation. According to CISA, attackers can chain it with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root. Both are PHP remote code execution flaws that CISA added to KEV on 2026-10-26 (NVD: CVE-2026-109618, NVD: CVE-2026-109619). CISA also flags the entry for forensic triage. Whether ransomware campaigns use it is listed as "Unknown."
What's Vulnerable
- Upstream Linux kernel: affected from version 3.9 (introducing commit
cef401de7be8) until the fixed stable releases below. - Fixed upstream versions: 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10, and 7.1.
- Red Hat fixed kernel packages:
- NVIDIA for RHEL 10:
6.12.0-211.8.el10nv/6.12.0-231.12.el10nv - RHEL 10.2:
6.12.0-211.16.1.el10_2 - RHEL 10.0 EUS:
6.12.0-55.75.1.el10_0 - RHEL 8 is also listed as affected.
Because the bug is in a core kernel component, CISA notes that it may affect many downstream products.
Patch Status
Fixes are available in the upstream stable trees. The patch propagates SKBFL_SHARED_FRAG whenever skb_try_coalesce() transfers paged fragments. Red Hat has released errata.
CISA's required action is to apply mitigations according to vendor instructions, following BOD 26-04 and CISA's Forensics Triage Requirements. If mitigations are unavailable, follow the BOD 26-04 guidance for cloud services or stop using the product. Federal agencies must remediate by 2026-10-31.
Sources
- CISA KEV catalog entry for CVE-2026-46300: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- NVD CVE-2026-46300: https://nvd.nist.gov/vuln/detail/CVE-2026-46300
- NVD CVE-2026-109618 (chained PHP flaw): https://nvd.nist.gov/vuln/detail/CVE-2026-109618
- NVD CVE-2026-109619 (chained PHP flaw): https://nvd.nist.gov/vuln/detail/CVE-2026-109619
- CISA alert, Critical Vulnerabilities in PHP Require Immediate Patching: https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
- CISA BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- CISA Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- Linux stable fix: https://git.kernel.org/stable/c/3599e6b3cc1ada96883d496a50a210d3afbb6987
- Linux stable fix: https://git.kernel.org/stable/c/f84eca5817390257cef78013d0112481c503b4a3
- oss-security: http://www.openwall.com/lists/oss-security/2026/05/13/5
- Red Hat RHSA-2026:19521: https://access.redhat.com/errata/RHSA-2026:19521
- Red Hat RHSA-2026:19540: https://access.redhat.com/errata/RHSA-2026:19540