Follow us on Google News
The United States Cybersecurity and Infrastructure Security Agency has added an actively exploited Linux kernel vulnerability to its Known Exploited Vulnerabilities catalogue, warning that attackers are chaining the security flaw with other exploits to obtain root-level access. Designated as CVE-2026-46300, the flaw was listed in the catalogue on October 28, 2026, with an established remediation deadline of October 31. Under Binding Operational Directive 26-04, federal authorities have directed affected organisations to initiate urgent forensic triage alongside remediation efforts. CISA cautioned that threat actors are pairing the flaw with two additional vulnerabilities, CVE-2026-109618 and CVE-2026-109619, to plant PHP webshells on compromised web servers and execute unauthorized system commands with elevated administrative privileges, although investigators have not confirmed whether the exploit chain has been deployed in ransomware attacks.
Flaw Traced to Socket Buffer Memory Management
The vulnerability originates in how the operating system kernel merges and processes network data held inside socket buffers. According to technical records, the skb_try_coalesce() function can transfer memory fragments linked to shared memory or the page cache without preserving the critical SKBFL_SHARED_FRAG security marker. Under standard operational rules, this marker informs subsequent kernel functions that specific memory segments are shared and must be handled with protective duplication safeguards. In the absence of the marker, the kernel treats shared data as eligible for direct in-place alterations during Encapsulating Security Payload input processing, thereby skipping protective data duplication and decrypting information directly within memory. This improper memory handling allows data backed by the page cache to be modified unintentionally, compromising internal memory integrity and enabling privilege escalation.
Local Attack Vector Carries High Severity Rating
Carrying a Common Vulnerability Scoring System score of 7.8, the flaw falls into the high-severity category. The official evaluation characterizes the issue as a local attack vector that requires low privileges and no interaction from an authorized user. The vulnerability does not represent an unauthenticated remote takeover mechanism when operating independently. Instead, security risks escalate significantly because malicious actors leverage the kernel flaw as a secondary component in a broader exploit sequence, elevating initial access into total control over affected machines. Securing root privileges presents severe operational dangers, granting threat actors the ability to manipulate core system configurations, extract sensitive data, disrupt network operations, and install persistent malicious components across organizational infrastructure.
Upstream Patches Released as Agencies Mandate Forensic Reviews
Upstream developers have resolved the vulnerability by ensuring the SKBFL_SHARED_FRAG marker remains intact whenever page-backed fragments pass between socket buffers. Remediation updates have been released across several supported branches, including versions 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, and 7.0.10, while version 7.1 remains unaffected by the issue. Administrators have been advised to consult their respective distribution channels and hardware vendors to verify kernel versions before deploying corresponding patches. CISA has emphasized that deploying security updates does not replace forensic investigations, urging teams to inspect systems for indicators of prior compromise. Entities unable to apply approved remediations have been directed to remove vulnerable assets from service.
