CISA adds exploited Linux kernel flaw CVE-2026-46300 to KEV

CISA added CVE-2026-46300 to its Known Exploited Vulnerabilities (KEV) catalogue on 28 October 2026. The flaw affects the Linux Kernel and is a missing initialisation of a variable vulnerability that can allow unintended modification of page-cache-backed data.

The vulnerability can occur when socket buffer coalescing fails to preserve a shared-fragment marker, causing ESP input processing to decrypt shared fragments in place. It can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root. The issue has a CVSS score of 7.8, rated HIGH. A patch is available.

CISA’s KEV listing confirms active exploitation. The available data does not confirm use in ransomware campaigns; ransomware use is listed as unknown. CISA set 31 October 2026 as the remediation deadline.

CISA requires agencies to apply mitigations in accordance with vendor instructions and applicable BOD 26-04 guidance, including its Forensics Triage Requirements. For cloud services, agencies should follow applicable BOD 26-04 guidance or discontinue use if mitigations are unavailable. Federal Civilian Executive Branch (FCEB) agencies are directly affected by the directive. All organisations should review their exposure, assess internet-facing assets and prioritise remediation.

For full details, consult the [NVD entry](https://nvd.nist[.]gov/vuln/detail/CVE-2026-46300) and [CISA KEV catalogue](https://www.cisa[.]gov/known-exploited-vulnerabilities-catalog).