HIGHCVSS 7.8Actively exploited · CISA KEV since 2026-10-28Vulnerability
CVE-2026-46300
Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.
Properties
- Vulnerability name
- Linux Kernel Missing Initialization of a Variable Vulnerability
- Cvss score
- 7.8
- Epss score
- 0.10192
- Due date
- 2026-10-31
- Retrieved at
- 2026-10-28T23:46:39+00:00
- Date added
- 2026-10-28
- Score
- 7.8
- Cvss vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- In Signal since
- initial import (Sep 2026)
- Vendor project
- Linux
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Published at
- 2026-05-23T12:17:02.660
- Last modified
- 2026-10-16T16:18:04.410
- Epss percentile
- 0.95651
- Severity
- HIGH
- Licence
- FIRST EPSS: free to use; attribution requested in publications or products (FAQ)
- Product
- Kernel
- Cvss severity
- HIGH
- Signal source
- FIRST EPSS
- Required action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discon
Related Entities (10)
AFFECTS_PRODUCT (5)
HAS_WEAKNESS (2)
DESCRIBES (1)
INVOLVES (1)
MENTIONED_IN (1)
Explore deeper with Ninja Signal's threat intelligence graph