CVE-2026-46300: Linux Kernel Missing Initialization of a Variable Vulnerability

Is it exploited?

Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 28 Oct 2026, 158 days after the CVE record was published.

How likely is exploitation in the next 30 days?

10.2%

EPSS score, percentile 95.7 of all scored records

How severe?

7.8 High

CVSS v3.1 base score, given by the CNA

What should I do?

CISA deadline 31 Oct 2026. Apply mitigations in accordance with vendor instructions … Full text

The CVE record links no vendor advisory, patch or mitigation.

Which versions are affected?

Affected

• from cef401de7be8c4e155c6746bfccf721a4fa5fab9 to before 3599e6b3cc1ada96883d496a50a210d3afbb6987
• from cef401de7be8c4e155c6746bfccf721a4fa5fab9 to before 2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c
• from cef401de7be8c4e155c6746bfccf721a4fa5fab9 to before 9d3e5fd19fe1063bf607219e8562fbd567b8e8d5
• from cef401de7be8c4e155c6746bfccf721a4fa5fab9 to before 78bf6b6bb19541d19fbda6242e7cfe2c682763c0
• from cef401de7be8c4e155c6746bfccf721a4fa5fab9 to before 760e1addc27ba1a7beb4a0a7e8b3e9ec49e7a34e
• from cef401de7be8c4e155c6746bfccf721a4fa5fab9 to before 3bd9e113d50034db99d7ef69fd8e5242d15e414a

and 3 more in the table below

Unaffected before 3.9; 5.10.257; 5.15.208; 6.1.174; 6.6.141; 6.12.91; and 3 more

Versions by product

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

What to do

CISA due date for this action: 31 October 2026.

Advisories and patches

The CVE record links no vendor advisory, patch or mitigation.

Linked from CISA's catalog entry

• https://git.kernel.org/stable/c/3599e6b3cc1ada96883d496a50a210d3afbb6987
• https://git.kernel.org/stable/c/2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c
• https://git.kernel.org/stable/c/9d3e5fd19fe1063bf607219e8562fbd567b8e8d5
• https://git.kernel.org/stable/c/78bf6b6bb19541d19fbda6242e7cfe2c682763c0
• https://git.kernel.org/stable/c/760e1addc27ba1a7beb4a0a7e8b3e9ec49e7a34e
• https://git.kernel.org/stable/c/3bd9e113d50034db99d7ef69fd8e5242d15e414a

Affected products and versions

As listed in the CVE record.

Versions not listed are: unaffected.

Versions not listed are: affected.

Versions the record lists as unaffected: 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10, 7.1.

Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

About this vulnerability

Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.

Summary: CISA's KEV catalog, as of 28 Oct 2026.

• CISA added CVE-2026-46300 to its Known Exploited Vulnerabilities (KEV) catalog on 28 Oct 2026.
• CISA's ransomware flag for this entry is "Unknown": no evidence of ransomware use in the catalog, which is not proof of none.
• The due date CISA sets for the required action is 31 Oct 2026.
• The CVE record was published on 23 May 2026, 158 days before it was added to KEV.
• The CVE record carries a CVSS v3.1 base score of 7.8 (High), given by its CNA.
• FIRST's EPSS model puts the probability of exploitation in the next 30 days at 10.2% (percentile 95.7), as of 28 Oct 2026.
• CISA's SSVC assessment in the CVE record: exploitation none, automatable no, technical impact total.

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026. About the data.

Description

net: skbuff: preserve shared-frag marker during coalescing

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.

Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

Weakness

• CWE-456: Missing Initialization of a Variable

CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record and the KEV entry.

Timeline

References

• git.kernel.org
• git.kernel.org
• git.kernel.org
• git.kernel.org
• git.kernel.org
• git.kernel.org
• git.kernel.org
• git.kernel.org

More exploited Linux vulnerabilities

• CVE-2025-39682: Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability (added 18 Sep 2026)
• CVE-2025-39964: Linux Kernel Race Condition Vulnerability (added 18 Sep 2026)
• CVE-2026-53266: Linux Kernel Out-of-Bounds Write Vulnerability (added 18 Sep 2026)
• CVE-2026-53362: Linux Kernel Unspecified Vulnerability (added 27 Aug 2026)
• CVE-2022-0995: Linux Kernel Out-of-Bounds Write Vulnerability (added 26 Aug 2026)
• CVE-2022-0492: Linux Kernel Improper Authentication Vulnerability (added 2 Jun 2026)