CVE-2026-46300 Exploited in the wild

Linux Kernel Missing Initialization of a Variable Vulnerability

Risk score: 100/100
CVSS: 7.8 v3.1
Exploit chance (30 days): 10.2%
Published: 23 May 2026
Added to CISA's exploited list: 28 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: A vulnerability in the Linux kernel allows an attacker to decrypt in place over page-cache backed frags, potentially leading to a high impact on confidentiality, integrity, and availability.
Affected: {'product': 'linux kernel', 'vendor': 'linux'}
Fix: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 guidance and CISA’s “Forensics Triage Requirements”
Exploitation: Exploited in the wild

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Linux Kernel: Red, act today. A vulnerability in the Linux kernel allows an attacker to decrypt in place over page-cache backed frags, potentially leading to a high impact on confidentiality, integrity, and availability.

The flaws

CVE-2026-46300: Linux Kernel Missing Initialization of a Variable Vulnerability (CVSS 7.8 · EPSS 10% · exploited)
CVE-2025-39964: Linux Kernel Race Condition Vulnerability (exploited)
CVE-2026-53266: Linux Kernel Out-of-Bounds Write Vulnerability (exploited)
CVE-2025-39682: Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability (exploited)

The fix

Fix: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 guidance and CISA’s “Forensics Triage Requirements”

Who is exposed: {'product': 'linux kernel', 'vendor': 'linux'}

Where it stands

Exploited in the wild
On CISA's exploited list since 18 Sep
US federal deadline 21 Sep
1 outlet covering it

How it unfolded

18 Sep, CISA (official): Added to the Known Exploited Vulnerabilities list (4 of these flaws)
21 Sep, Deadline (official): US federal agencies must have patched
28 Oct, CISA advisories (US) (official): CISA Adds Two Known Exploited Vulnerabilities to Catalog
28 Oct, SecurityWeek (press): China-Linked Hackers Exploit PHP2Shell to Root Firewalls

Connects to

Same product: Earlier Linux Kernel warnings. 2 in the last 90 days
Reported alongside: PHP Stale Internal Request-State Vulnerability. CVE-2026-109619 · in 1 of the same article
Reported alongside: PHP Memory Corruption Vulnerability. CVE-2026-109618 · in 1 of the same article

In the news

TL;DR

China-linked hackers exploit CVE-2026-46300 to gain root access to firewalls and deploy webshells.

China-linked threat actor exploits CVE-2026-46300 in Linux kernel.
Attackers chain CVE-2026-46300 with PHP2Shell vulnerabilities.
25 firewalls exploited, 24 devices dropped PHP root webshell.
Two US government-affiliated servers compromised.

AI summary of 1 article.

China-Linked Hackers Exploit PHP2Shell to Root Firewalls
SecurityWeek28 Oct 2026

Why it is Red

CVSS 7.8 high
Exploitation likely: EPSS 10.2% (top 4%)
Exploited in the wild (CISA KEV)
On your watchlist: linux kernel
Named in a government or vendor bulletin

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Government and vendor bulletins

CISA Adds Two Known Exploited Vulnerabilities to Catalog

References

Original description

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.

Last activity 28 Oct 2026. Patch Forecast updates every hour.