CISA Warns of Linux Kernel Missing Initialization Vulnerability Exploited in Attacks

The U.S. Cybersecurity and Infrastructure Security Agency has warned that attackers are exploiting a Linux kernel vulnerability (CVE-2026-46300) that can help them gain control of affected systems.

The flaw was added to CISA’s Known Exploited Vulnerabilities catalog on October 28, 2026, placing it among security issues with confirmed exploitation. CISA’s catalog entry sets an October 31 remediation deadline and requires forensic triage under Binding Operational Directive 26-04.

The agency says attackers can chain the kernel flaw with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root. It remains unknown whether the vulnerability has been used in ransomware campaigns.

The flaw affects how the Linux kernel combines network data held in socket buffers. According to the official CVE record, the skb_try_coalesce() function can transfer fragments backed by shared memory or the page cache without preserving the SKBFL_SHARED_FRAG marker. This marker tells later code that the data needs special handling before modification.

When that marker disappears, the kernel can incorrectly treat shared fragments as safe to change directly. During Encapsulating Security Payload, or ESP, input processing, the kernel may skip a protective copying step and decrypt data in place. This can modify page-cache-backed data that should not have been changed through that path.

The published CVSS score is 7.8, rated high severity. Its assessment describes a local attack requiring low privileges and no user interaction.

Linux Kernel Missing Initialization Vulnerability Exploited

That is important because the kernel flaw alone should not be described as an unauthenticated remote takeover. CISA’s warning instead highlights its use alongside other vulnerabilities in a broader attack chain.

The upstream fix preserves the shared-fragment marker when paged fragments move between socket buffers. The CVE record identifies fixed releases across several maintained branches, including Linux 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, and 7.0.10. Linux 7.1 is also listed as unaffected.

Administrators should follow their Linux distribution or product vendor’s guidance when selecting updates. CISA’s entry calls for vendor-approved mitigations, checks of internet exposure, and compliance with applicable patching and forensic requirements. When mitigations aren’t available, it instructs organizations to stop using the affected product.

The warning follows earlier reports of Linux kernel vulnerabilities actively exploited and a separate Linux kernel privilege escalation vulnerability exploited in attacks. Those cases also involved short remediation deadlines and forensic review, showing why patching and checking for compromise must remain separate tasks.

For affected organizations, the immediate concern is the combination of confirmed exploitation, possible root access, and a tight deadline. The CISA alert makes this an urgent security response, not a routine update.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post CISA Warns of Linux Kernel Missing Initialization Vulnerability Exploited in Attacks appeared first on Cyber Security News.