Linux kernel: CVE-2026-46300 exploited, writes to the page cache

On 28 October 2026 CISA added CVE-2026-46300 to its Known Exploited Vulnerabilities (KEV) catalog, under the name “Linux Kernel Missing Initialization of a Variable Vulnerability”. With its addition to the KEV, this Linux kernel vulnerability is considered exploited in real attacks. The deadline for US federal agencies is very close: 31 October 2026.

The CVE itself is not new: its NVD record was published on 23 May 2026, with the vulnerability already described as fixed, and was updated on 28 October. NVD currently lists it as still undergoing analysis.

This article is based on a single source, the KEV catalog entry with the description and data published in the NVD database: the information that follows is what is reported there.

What happened

The flaw is in the kernel’s networking stack, in the code that handles packet buffers (skbuff). According to the description of the fix, the skb_try_coalesce() function can move data fragments from one packet to another in order to merge them. If the source packet carries the SKBFL_SHARED_FRAG marker, which flags shared fragments, the resulting packet can contain the same fragments, externally owned or backed by the page cache (the kernel’s file cache), but the marker is lost.

Other parts of the kernel rely on that marker before writing directly over the data. The description specifically mentions ESP input (the encryption protocol of IPsec): before deciding whether it can skip copying the data with skb_cow_data(), it checks skb_has_shared_frag(). If TCP receive coalescing has moved shared fragments into an unmarked packet, the check returns false and ESP can decrypt in place, over fragments backed by the page cache.

The name used in the KEV catalog matches weakness CWE-456 (missing initialization of a variable); the technical description talks about a marker that is lost when packets are merged.

Technical details

• CVE: CVE-2026-46300.
• Product: Linux kernel, networking stack (net: skbuff).
• Weaknesses: CWE-787 (out-of-bounds write), CWE-456 (missing initialization of a variable), CWE-123 (write-what-where condition).
• CVSS 3.1 score: 7.8 (high), with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H: local attack, low complexity, low privileges, no user interaction, high impact on confidentiality, integrity and availability. The NVD record lists two identical assessments, one of them by NVD.
• Fix: the patch propagates the SKBFL_SHARED_FRAG marker when skb_try_coalesce() transfers fragments. The copy into the packet’s tailroom does not need it, because it copies the bytes instead of transferring references to the fragments. The NVD record lists eight fix commits in the kernel’s stable branches and posts on the oss-security mailing list dated 13 and 21 May 2026.
• Exploitation: confirmed by CISA through its addition to the KEV catalog. According to CISA, use in ransomware campaigns is currently unknown.
• Attack chain and indicators: the source does not describe how the vulnerability was exploited and lists no MITRE ATT&CK techniques or indicators of compromise.

Affected versions

According to NVD data, these kernel versions are affected:

• from 3.9 up to and including 5.10.257;
• from 5.11 up to, but not including, 5.15.208;
• from 5.16 up to, but not including, 6.1.174;
• from 6.2 up to, but not including, 6.6.141;
• from 6.7 up to, but not including, 6.12.91;
• from 6.13 up to, but not including, 6.18.33;
• from 6.19 up to, but not including, 7.0.10;
• 7.1.

The versions given as excluded upper bounds (for example 6.12.91 or 7.0.10) are not listed as affected. For the 5.10 branch the source does not give the first fixed version. The record’s references also include numerous Red Hat advisories (RHSA and RHBA); for other distributions, what matters is the kernel package each one publishes, which may carry a different version number from the upstream kernel.

Impact for European and Italian companies

The Linux kernel is everywhere: physical and virtual servers, virtualization and container hosts, network and security appliances, embedded systems. The CVSS vector points to a local attack with low privileges: anyone who already has an account or a process on the machine, for example through a compromised service or an unprivileged user, can reach high impact on confidentiality, integrity and availability. Systems shared by several users or running untrusted code are therefore the most exposed.

For organizations within the scope of NIS2, the update is part of the vulnerability management the directive requires, and a compromise must be assessed for notification to the national CSIRT, which in Italy is CSIRT Italia at ACN. The same applies to healthcare organizations, which often run Linux servers and devices behind their clinical applications.

What to do now

1. Inventory: identify your Linux systems and the running kernel version, including vendor appliances and devices, and compare it with the ranges above.
2. Update: install the fixed kernel published by your distribution or appliance vendor (look for CVE-2026-46300 in their advisories) and reboot: until the system loads the new kernel, the vulnerability remains. CISA asks to apply the vendor’s mitigations or, if none are available, to discontinue use of the product.
3. Prioritize systems with many users or running untrusted code: shared servers, container hosts, CI runners, development machines, as well as those that use IPsec, the path mentioned in the description.
4. Ask your vendors of Linux-based appliances whether and when they include the fix. The source gives no temporary workarounds.
5. Look for signs of compromise: CISA points to its forensics triage requirements. Check for unexpected accounts and processes, changes to system files and kernel crashes on systems that went a long time without updates.

How ARXDOME helps

ARX Sentry collects logs, events and inventory from servers running the agent: it helps you find your Linux systems and their kernel versions. ARX Shield shows open vulnerabilities by machine and by package and highlights those already exploited, so you can track the update system by system. With ARX Horizon you can look up vulnerability details from the portal.

Last updated: 28 October 2026