CISA Warns of Linux Kernel Missing Initialization Vulnerability Exploited in Attacks

What happened?

The U.S. Cybersecurity and Infrastructure Security Agency has warned that attackers are exploiting a Linux kernel vulnerability (CVE-2026-46300) that can help them gain control of affected systems. The flaw was added to CISA’s Known Exploited Vulnerabilities catalog on October 28, 2026, placing it among security issues with confirmed exploitation. CISA’s catalog entry sets an October 31 remediation deadline and requires forensic triage under Binding Operational Directive 26-04.

Key details

• CISA added a Linux kernel missing initialization flaw to its Known Exploited Vulnerabilities catalog on October 28, 2026.
• Attackers chain the kernel flaw with two other CVEs to implant PHP webshells and execute commands as root.
• The vulnerability involves the skb_try_coalesce() function dropping the SKBFL_SHARED_FRAG marker during socket buffer operations.
• CISA set an October 31 remediation deadline and requires forensic triage under Binding Operational Directive 26-04.
• The CVSS score is 7.8, rated high severity, with a local attack vector requiring low privileges and no user interaction.
• Upstream fixes preserve the shared-fragment marker when paged fragments move between socket buffers across multiple kernel branches.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.