What happened
A critical vulnerability has been identified in the Linux Kernel, associated with CVE-2026-46300. The flaw involves a missing initialization of a variable that can be exploited to modify page-cache-backed data. Specifically, failure to preserve the shared-fragment marker during socket buffer coalescing enables an attacker to cause ESP input processing to decrypt shared fragments in place. Exploitation of this vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to facilitate the implantation of PHP webshells and command execution as root. Active exploitation has been confirmed in the wild, underscoring the urgency for affected organisations to address this issue promptly.
Who is affected
Organisations running Linux Kernel in affected deployments are at risk. Systems exposed to the internet or within untrusted networks are particularly vulnerable, especially if they rely on socket buffer handling or experience significant network coalescing activities. No specific versions or build numbers are provided; all affected environments should assess their Linux Kernel implementations for potential impact and vulnerability exposure.
Recommended actions
- Apply mitigations according to vendor instructions promptly, ensuring compliance with CISA’s BOD 26-04 guidance on prioritising security updates based on risk.
- Verify that mitigation measures address the specific attack vector involving socket buffer coalescing and shared fragment preservation.
- Follow CISA’s "Forensics Triage Requirements" to assist in identifying potential compromise and to support incident response efforts.
- If mitigation options are unavailable, consider discontinuing use of the vulnerable Linux Kernel components until patches or mitigations are accessible.
- Stakeholders are responsible for evaluating each asset’s internet exposure and ensuring adherence to BOD 26-04 patching guidelines accordingly.
