{ "schemaVersion": 1, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "incident": { "id": "cve-2026-46300", "url": "https://cveboard.org/i/cve-2026-46300", "urlPt": "https://cveboard.org/pt/i/cve-2026-46300", "json": "https://cveboard.org/i/cve-2026-46300.json", "kind": "vuln", "live": true, "knownExploited": true, "severity": "high", "title": "Linux Kernel Missing Initialization of a Variable Vulnerability", "summary": "Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.", "titlePt": "Vulnerabilidade de inicialização ausente de uma variável no Kernel Linux", "summaryPt": "O Kernel Linux contém uma vulnerabilidade de inicialização ausente de uma variável que pode permitir a modificação não intencional de dados baseados em cache de páginas por meio de falha na preservação do marcador de fragmento compartilhado durante a coalescência de buffers de soquete, causando o processamento de entrada ESP para descriptografar fragmentos compartilhados no local. Esta vulnerabilidade pode ser encadeada com CVE-2026-109618 e CVE-2026-109619 para implantar webshells PHP e executar comandos como root.", "affected": [ { "vendor": "Linux", "product": "Linux", "defaultStatus": "unaffected", "versions": [], "omitted": 8, "fixed": [] }, { "vendor": "Linux", "product": "Linux", "defaultStatus": "affected", "versions": [ { "version": "3.9", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": "0", "status": "unaffected", "lessThan": "3.9", "lessThanOrEqual": null }, { "version": "5.10.257", "status": "unaffected", "lessThan": null, "lessThanOrEqual": "5.10.*" }, { "version": "5.15.208", "status": "unaffected", "lessThan": null, "lessThanOrEqual": "5.15.*" }, { "version": "6.1.174", "status": "unaffected", "lessThan": null, "lessThanOrEqual": "6.1.*" }, { "version": "6.6.141", "status": "unaffected", "lessThan": null, "lessThanOrEqual": "6.6.*" }, { "version": "6.12.91", "status": "unaffected", "lessThan": null, "lessThanOrEqual": "6.12.*" }, { "version": "6.18.33", "status": "unaffected", "lessThan": null, "lessThanOrEqual": "6.18.*" }, { "version": "7.0.10", "status": "unaffected", "lessThan": null, "lessThanOrEqual": "7.0.*" }, { "version": "7.1", "status": "unaffected", "lessThan": null, "lessThanOrEqual": "*" } ], "omitted": 0, "fixed": [ "5.10.257", "5.15.208", "6.1.174", "6.6.141", "6.12.91", "6.18.33", "7.0.10", "7.1" ] } ], "omitted": 8, "references": [ { "url": "https://access.redhat.com/errata/RHSA-2026:19540", "tag": "vendor-advisory" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33486", "tag": "vendor-advisory" }, { "url": "https://access.redhat.com/errata/RHBA-2026:20032", "tag": "vendor-advisory" }, { "url": "https://access.redhat.com/errata/RHSA-2026:21695", "tag": "vendor-advisory" }, { "url": "https://access.redhat.com/errata/RHSA-2026:21690", "tag": "vendor-advisory" }, { "url": "https://access.redhat.com/errata/RHSA-2026:28887", "tag": "vendor-advisory" }, { "url": "https://access.redhat.com/errata/RHSA-2026:23233", "tag": "vendor-advisory" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20087", "tag": "vendor-advisory" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25044", "tag": "vendor-advisory" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34098", "tag": "vendor-advisory" }, { "url": "https://access.redhat.com/errata/RHSA-2026:21656", "tag": "vendor-advisory" }, { "url": "https://access.redhat.com/errata/RHSA-2026:23245", "tag": "vendor-advisory" } ], "cwes": [ { "id": "CWE-456", "name": "Missing Initialization of a Variable" } ], "ssvc": { "exploitation": "none", "automatable": "no", "impact": "total", "at": "2026-10-16T15:21:41.697Z" }, "fix": "listed", "tags": [ "linux" ], "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: preserve shared-frag marker during coalescing\n\nskb_try_coalesce() can attach paged frags from @from to @to. If @from\nhas SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same\nexternally-owned or page-cache-backed frags, but the shared-frag marker\nis currently lost.\n\nThat breaks the invariant relied on by later in-place writers. In\nparticular, ESP input checks skb_has_shared_frag() before deciding\nwhether an uncloned nonlinear skb can skip skb_cow_data(). If TCP\nreceive coalescing has moved shared frags into an unmarked skb, ESP can\nsee skb_has_shared_frag() as false and decrypt in place over page-cache\nbacked frags.\n\nPropagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged\nfrags. The tailroom copy path does not need the marker because it copies\nbytes into @to's linear data rather than transferring frag descriptors.", "descriptionFrom": "cve", "descriptionAt": null, "summaryFrom": "kev", "cves": [ "CVE-2026-46300" ], "ghsa": null, "cvss": { "score": 7.8, "version": "3.1", "by": "Linux" }, "epss": { "percentage": 0.10192, "percentile": 0.95651, "asOf": "2026-10-28", "by": "FIRST" }, "packages": [], "vendor": "Linux", "product": "Kernel", "kev": { "dateAdded": "2026-10-28", "dueDate": "2026-10-31", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.", "ransomware": false }, "breach": null, "retracted": false, "sources": [ { "label": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-46300" } ], "cveVersion": 1, "cvePending": false, "publishedAt": "2026-10-28T00:00:00.000Z", "updatedAt": "2026-10-28T00:00:00.000Z" }, "live": true, "events": [ { "id": "kev:CVE-2026-46300:kev_added:2026-10-28T00:00:00.000Z", "incidentId": "cve-2026-46300", "type": "kev_added", "at": "2026-10-28T00:00:00.000Z", "detail": { "dueDate": "2026-10-31", "ransomware": false } } ] }