Snapshot of public data from 31 Oct 2026, 12:50:06. This data is not updated until the API is deployed.

CVE-2026-46300

Linux Kernel Missing Initialization of a Variable Vulnerability

UrgentCVSS 7.8 v3.1Exploited

Why this priority

Generic watch priority computed by public, versioned rules. It does not know your assets. See the glossary

Présent dans le catalogue CISA KEV (exploitation confirmée)

Description

Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.

Affected products

Vendor	Product	Versions
Linux	Linux	3.9
Linux	Linux	from cef401de7be8c4e155c6746bfccf721a4fa5fab9 to 3599e6b3cc1ada96883d496a50a210d3afbb6987 excluded from cef401de7be8c4e155c6746bfccf721a4fa5fab9 to 2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c excluded from cef401de7be8c4e155c6746bfccf721a4fa5fab9 to 9d3e5fd19fe1063bf607219e8562fbd567b8e8d5 excluded from cef401de7be8c4e155c6746bfccf721a4fa5fab9 to 78bf6b6bb19541d19fbda6242e7cfe2c682763c0 excluded from cef401de7be8c4e155c6746bfccf721a4fa5fab9 to 760e1addc27ba1a7beb4a0a7e8b3e9ec49e7a34e excluded from cef401de7be8c4e155c6746bfccf721a4fa5fab9 to 3bd9e113d50034db99d7ef69fd8e5242d15e414a excluded from cef401de7be8c4e155c6746bfccf721a4fa5fab9 to 3884358a9286b17f389a72b1426fc4547c23c111 excluded from cef401de7be8c4e155c6746bfccf721a4fa5fab9 to f84eca5817390257cef78013d0112481c503b4a3 excluded
Linux	Kernel	All versions

Revision history

Revision 3 31 Oct 2026, 12:49:55
Revision 2 31 Oct 2026, 12:28:31
Update : Affected versions changed
Revision 1 31 Oct 2026, 12:26:43
New record

Qualification

CVSS severity ? Technical severity score between 0 and 10, with its version (3.1, 4.0). See the glossary: 7.8 HIGH CVSS v3.1CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KEV catalog ? CISA catalog of vulnerabilities with confirmed exploitation. Absence from the catalog does not prove absence of exploitation. See the glossary: Listed
Exploitation: Confirmed
EPSS probability ? Probability, between 0 and 1, that a vulnerability is exploited in the next 30 days, published daily by FIRST. Always dated. See the glossary: Unknown
Confidence ? Quality of the sources behind the record. It is not a risk score. See the glossary: High

Priority rules, version 1

CISA KEV catalog

Added on: 28 October 2026
Federal due date: 31 October 2026
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Ransomware use: Unknown