Linux Kernel Missing Initialization of a Variable Vulnerability (CVE-2026-46300)

What is affected, what to do

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost.

The vulnerability is being actively exploited; treat it as a priority. Update Linux Kernel to version 5.10.257, Linux Kernel to version 5.15.208, Linux Kernel to version 6.1.174. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Linux Kernel lt 3.9..5.10.257
• Linux Kernel lt 5.11..5.15.208
• Linux Kernel lt 5.16..6.1.174
• Linux Kernel lt 6.2..6.6.141
• Linux Kernel lt 6.7..6.12.91
• Linux Kernel lt 6.13..6.18.33
• Linux Kernel lt 6.19..7.0.10

Fixed in

• Linux Kernel 5.10.257
• Linux Kernel 5.15.208
• Linux Kernel 6.1.174
• Linux Kernel 6.6.141
• Linux Kernel 6.12.91
• Linux Kernel 6.18.33
• Linux Kernel 7.0.10
• Linux Kernel 7.1

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory kernel versions. All branches 3.9 through 7.0.10 are vulnerable. Deploy fixed releases 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10 or 7.1 depending on your LTS line. Pull vendor backports (RHEL/Oracle kernel-*, SUSE kernel-default, Ubuntu linux-image, Debian linux-image) and schedule yum/dnf update kernel or equivalent.
   • Prioritise reboot windows for every IPsec/ESP terminator: VPN concentrators, strongSwan/Libreswan gateways, site-to-site routers. The flaw manifests in the ESP input path, so IPsec endpoints are the primary at-risk asset class.
   • For hosts you cannot reboot immediately: inspect ESP hardware offload (ethtool -k | grep esp-hw-offload) and disable GRO/LRO to reduce the vulnerable coalescing behaviour: ethtool -K gro off lro off.
   • Local attack vector (AV:L, PR:L) means any user-space code execution on an IPsec endpoint is the lever. Shell access on VPN gateways, containers holding CAP_NET_RAW, and multi-tenant hosts get patched first. Temporarily restrict interactive logins on those systems to break-glass accounts.
   • Factor in the exploitation chain: the advisory names CVE-2026-109618 and CVE-2026-109619 as co-exploits used to drop PHP webshells and execute as root. Web servers running PHP-FPM on an unpatched kernel are top priority — scan webroots for unexpected .php files.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: terminate IPsec on dedicated appliances that do not host tenant workloads. Constrain the lateral path from VPN concentrator to web-tier VLANs via microsegmentation (nftables, Calico NetworkPolicy, VMware NSX).
   • Endpoint hardening: set kernel.unprivileged_userns_clone=0, kernel.kptr_restrict=2, kernel.dmesg_restrict=1. Tighten AppArmor/SELinux profiles so that web-server processes cannot write outside /var/www/uploads — this breaks the described webshell drop.
   • ESP-path configuration: audit TCP receive coalescing (tcp_moderate_rcvbuf, GRO) on ESP-terminating hosts. For XFRM-based IPsec, consider forcing software crypto in place of hardware offload until the kernel fix lands.
   • IAM and least privilege: audit SUID binaries (find / -perm -4000 -type f), strip unnecessary capabilities (CAP_NET_ADMIN, CAP_SYS_MODULE) from container specs. Do not let PHP-FPM run as www-data with write access to its own configuration.
   • WAF and reverse proxy: whitelist Content-Type on upload endpoints, and hard-disable .php execution inside upload directories at the web-server config layer (nginx location block, Apache ) — second line of defence against the chain.
   • Integrity monitoring: baseline /var/www, /usr/share/nginx/html and vendor webroots with AIDE or Tripwire, ship daily diff reports to the SIEM.
3. 03

   Runbook step 3

   Detection rules

   • Auditd for suspect kernel modules and capability abuse: -a always,exit -F arch=b64 -S init_module,finit_module -k mod_load and -a always,exit -F arch=b64 -S setuid -F a0=0 -F auid>=1000 -k priv_esc. Alert when uid!=0 and euid==0 appear in the same process tree.
   • Sysmon-for-Linux/EDR: new .php files under webroots with a process ancestry outside the expected deploy pipeline. KQL-shaped: DeviceFileEvents | where FolderPath has_any("/var/www","/srv/www") and FileName endswith ".php" and InitiatingProcessFileName !in ("rsync","git","ansible-playbook").
   • Network telemetry (Zeek/Suricata): unusual rates of ESP errors in kernel logs (dmesg | grep -iE "xfrm|esp.*(bad|error)") as a proxy for mishandled packets. Tune Suricata signatures for POST requests carrying base64-encoded PHP payloads to upload endpoints.
   • Web access logs: GET requests to .php paths that were never deployed, returning HTTP 200 — Sigma shape: selection: cs-method: GET, cs-uri-stem|endswith: .php, sc-status: 200; filter: cs-uri-stem|startswith deploy-manifest; condition: selection and not filter.
   • Process telemetry: php-fpm or apache2 as parent of bash, sh, nc, curl, wget with outbound network egress. Critical when the child runs as uid=0 — direct indicator of the described root RCE chain.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.

Source: BSI WID Portal, BSI CSAF, siemens_advisory, Ubuntu Security Notices, Debian LTS Advisories, redhat_csaf, Microsoft Security Update Guide, ENISA EUVD, Debian Security Advisories, cvelistv5, pwn.watch, NVD (NIST), CISA KEV Catalog, CVE.org (MITRE), suse_csaf

Vendors and products

• Debian Linux
• Debian Linux-6.1
• IBM Datapower Gateway
• Linux Linux
• Linux Linux Kernel
• Red Hat Enterprise Linux

Weakness classes (CWE)

• CWE-456Missing Initialization of a Variable

  Variant

  The product does not initialize critical variables, which causes the execution environment to use unexpected values.

  Entry at MITRE CWE-456

References & sources

• git.kernel.orgstable/c/3599e6b3cc1ada96883d496a50a210d3afbb6987euvd, Patch
• git.kernel.orgstable/c/2f2b16022a2e10ca7bccfb98db5ed2ec0f72641ceuvd, Patch
• git.kernel.orgstable/c/9d3e5fd19fe1063bf607219e8562fbd567b8e8d5euvd, Patch
• git.kernel.orgstable/c/78bf6b6bb19541d19fbda6242e7cfe2c682763c0euvd, Patch
• git.kernel.orgstable/c/760e1addc27ba1a7beb4a0a7e8b3e9ec49e7a34eeuvd, Patch
• git.kernel.orgstable/c/3bd9e113d50034db99d7ef69fd8e5242d15e414aeuvd, Patch
• git.kernel.orgstable/c/3884358a9286b17f389a72b1426fc4547c23c111euvd, Patch
• git.kernel.orgstable/c/f84eca5817390257cef78013d0112481c503b4a3euvd, Patch
• openwall.comlists/oss-security/2026/05/13/5Mailing list
• openwall.comlists/oss-security/2026/05/21/11Mailing list
• openwall.comlists/oss-security/2026/05/21/12Mailing list
• openwall.comlists/oss-security/2026/05/21/13Mailing list
• access.redhat.comsecurity/cve/CVE-2026-46300Vulnerability database, x_refsource_REDHAT
• bugzilla.redhat.comRHBZ#2477015Issue tracking, x_refsource_REDHAT
• security.access.redhat.comdata/csaf/v2/vex/2026/cve-2026-46300.jsonx_sadp-csaf-vex
• access.redhat.comerrata/RHSA-2026:19540Vendor advisory, x_refsource_REDHAT
• access.redhat.comerrata/RHSA-2026:33486Vendor advisory, x_refsource_REDHAT
• access.redhat.comerrata/RHBA-2026:20032Vendor advisory, x_refsource_REDHAT
• access.redhat.comerrata/RHSA-2026:21695Vendor advisory, x_refsource_REDHAT
• access.redhat.comerrata/RHSA-2026:21690Vendor advisory, x_refsource_REDHAT

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 29.10.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: no

   Show 2 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	removed	{"id":"CVE-2026-46300","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-10-28T19:50:15.868416Z"}	—
   SSVC assessment	added	—	{"id":"CVE-2026-46300","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-05-14T00:00:00+00:00"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

2. 28.10.2026CISA KEV entry updated9119a7d8…

   4 individual changes: Date Added, Due Date, Required Action, Vulnerability Name

   Show 4 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Date Added	added	—	2026-10-28
   Due Date	added	—	2026-10-28
   Required Action	added	—	2026-10-28
   Vulnerability Name	added	—	2026-10-28

   Source identifier: 9119a7d8-5eab-497f-8521-727c672e3725

3. 28.10.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: no

   New references:

   • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-46300
   Show 3 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Reference	added	—	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-46300
   SSVC assessment	removed	{"id":"CVE-2026-46300","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T15:21:41.697372Z"}	—
   SSVC assessment	added	—	{"id":"CVE-2026-46300","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-10-28T19:50:15.868416Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

4. 19.10.2026Record modifiedCISA ADP

   Weakness type: CWE-456

   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Weakness type (CWE)	added	—	CWE-456

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

5. 16.10.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: none known, automatable: no

   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	added	—	{"id":"CVE-2026-46300","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T15:21:41.697372Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

One NVD translation into another language is hidden.

Linked advisories

• Third Linux Kernel Privilege Escalation Flaw in Two WeeksSANS NewsBites13.05.2026