A Tight Deadline for a Flaw Already Being Exploited

The Cybersecurity and Infrastructure Security Agency has confirmed that a Linux kernel vulnerability is being actively exploited in the wild, adding it to its Known Exploited Vulnerabilities catalog on October 28, 2026. The flaw, tracked as CVE-2026-46300, carries a CVSS score of 7.8 and gives federal civilian agencies only until October 31 to apply mitigations, alongside a requirement under Binding Operational Directive 26-04 to carry out forensic triage on potentially affected systems rather than simply patching and moving on.

That short window, combined with the forensic requirement, signals that CISA views this less as a routine bug fix and more as an incident that may already have left systems compromised somewhere in federal networks.

What Actually Goes Wrong Inside the Kernel

At the technical level, the bug lives in how the Linux kernel manages network data stored in socket buffers. A function called skb_try_coalesce() can merge data fragments that are backed by shared memory or the page cache without properly preserving a marker — SKBFL_SHARED_FRAG — that exists specifically to tell later code “handle this carefully, it’s shared.” When that marker gets dropped, the kernel can be fooled into treating protected, shared data as if it were safe to modify directly.

The practical trigger involves IPsec’s Encapsulating Security Payload processing. During certain input handling, the kernel can skip a copy step it normally performs before decrypting data, and decrypt it in place instead — directly altering data backed by the page cache that should never have been touched that way. CISA’s advisory frames this as a local, low-privilege attack path that needs no user interaction, which is precisely what makes it attractive to attackers who already have a toehold on a system and want to escalate.

Part of a Larger Attack Chain

CISA’s write-up is careful to note that this flaw by itself is not a remote, unauthenticated takeover. The real danger comes from chaining it with two other vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which together reportedly allow attackers to implant PHP webshells and execute commands with root privileges. Whether this chain has been used in ransomware operations specifically remains unconfirmed, but the combination of root-level code execution and webshell persistence is exactly the kind of foothold ransomware crews typically look to establish before encrypting or exfiltrating data.

This is not the first kernel-level warning of its kind this month. CISA’s advisory references earlier disclosures of actively exploited Linux kernel bugs, including a separate privilege-escalation flaw, suggesting attackers are systematically probing the kernel for chainable weaknesses rather than relying on a single silver-bullet exploit.

Which Versions Are Fixed

Upstream maintainers have already shipped a fix that restores the shared-fragment marker whenever paged fragments move between socket buffers. According to the official CVE record, the patched releases include:

• Linux 5.10.257
• Linux 5.15.208
• Linux 6.1.174
• Linux 6.6.141
• Linux 6.12.91
• Linux 6.18.33
• Linux 7.0.10

Linux 7.1 was not affected by the flaw in the first place. Because most organizations run a distribution-maintained kernel rather than a raw upstream build, CISA is directing administrators to follow their Linux distribution’s or product vendor’s specific patch guidance rather than attempting to apply the upstream fix directly.

What Security Teams Should Do Now

For organizations covered by the federal directive, the instructions are blunt: apply vendor-approved mitigations, check for internet-facing exposure, and where no fix is currently available, stop using the affected product altogether until one is released. Even outside the federal government, the advisory is a useful prompt for any team running Linux at scale to:

• Inventory kernel versions across production and cloud fleets and prioritize unpatched systems that are internet-reachable.
• Treat patching and compromise-checking as two separate tasks — applying a fix does not retroactively clean up a system that was already exploited.
• Watch specifically for signs of the follow-on webshell activity associated with the two companion CVEs, not just the kernel bug in isolation.

With confirmed in-the-wild exploitation, a short remediation clock, and a plausible path to root access, this is squarely the kind of advisory that belongs at the top of a patch queue rather than in a routine maintenance window.