Linux Kernel Missing Initialization of a Variable Vulnerability

🚨SEVERITY: HIGH — CVSS 7.8Security Advisory

TL;DR 📌

  • Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run…
  • Highest CVSS: 7.8 (High).
  • Listed in CISA KEV (2026-10-28) — this is being exploited in the wild.
  • Fixed in 5.15.208, 6.1.174, 6.12.91, 6.18.33 — upgrade to this release or later.
  • CVEs: CVE-2026-46300.

What it is

Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.

For leadership 🧭

Executive summary. Risk is High (CVSS 7.8) across any Linux kit you run. Follow the remediation in the vendor advisory within Immediate — CISA KEV entries carry a federal remediation deadline.

Why it matters:

  • Exposure depends on deployment topology and which access paths reach the affected component.
  • Treat internet-facing and management-plane instances as higher risk than internal-only ones.
  • Keep monitoring for abnormal authentication and configuration events until upgrades complete.

Now / Next / Later:

  • Now: confirm whether you run the affected versions, and check exposure of any that are internet-facing.
  • Next: apply the remediation the advisory specifies, through an approved change window.
  • Later: add a control check so builds cannot drift back onto a vulnerable train.

Source