HighCVECVE-2026-46300
[CVE-2026-46300] Linux Kernel — Linux Kernel Missing Initialization of a Variable Vulnerability
CISA KEV·Source published ·1 min read
What happened?
Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.
Key details
- A missing variable initialization in the Linux kernel allows unintended modification of page-cache-backed data.
- The flaw occurs when the shared-fragment marker is not preserved during socket buffer coalescing.
- ESP input processing decrypts shared fragments in place because of the missing initialization.
- This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.
- Forensic triage is required per CISA Binding Operational Directive 26-04.
Affected
- Linux Kernel (open-source component used by multiple products).
Fixes and mitigations
- Apply mitigations in accordance with vendor instructions and CISA BOD 26-04 guidance.
- Follow BOD 26-04 guidance for cloud services or discontinue use if mitigations are unavailable.
Summarised by SecOraLens from CISA KEV. Always read the original source before acting. How SecOraLens verifies advisories.