Linux Kernel CVE-2026-46300: patch now, it is exploited

What CVE-2026-46300 is and who it affectsCVE-2026-46300 is a vulnerability in the Linux Kernel, officially described as a missing initialisation of a...

What CVE-2026-46300 is and who it affects

CVE-2026-46300 is a vulnerability in the Linux Kernel, officially described as a missing initialisation of a variable flaw. In practice, the problem sits in the network stack: skb_try_coalesce() can move paged fragments from one socket buffer to another, and when the source buffer carries the SKBFL_SHARED_FRAG marker, that marker is lost. Later in-place writers then trust an invariant that no longer holds. In particular, ESP input checks whether a buffer has shared fragments before deciding to skip a copy; if TCP receive coalescing has stripped the marker, ESP can decrypt in place over page-cache-backed data.

The NVD classifies it under CWE-787, CWE-456 and CWE-123, with a CVSS 3.1 score of 7.8 (HIGH). It was published in the NVD on 23 May 2026. Affected ranges are broad and cover most long-term and current branches:

From 3.9 up to and including 5.10.257
From 5.11 up to, but not including, 5.15.208
From 5.16 up to, but not including, 6.1.174
From 6.2 up to, but not including, 6.6.141
From 6.7 up to, but not including, 6.12.91
From 6.13 up to, but not including, 6.18.33
From 6.19 up to, but not including, 7.0.10
Release candidates 7.1 rc1, rc2, rc3 and rc4

That reach matters for Spanish SMEs and online shops, because the kernel sits underneath everything: the VPS or dedicated server running WordPress, PrestaShop or Joomla, the container host, the firewall appliance. If you run your own infrastructure in Barcelona, Lleida, Tarragona or Girona, or your hosting provider does, this is your layer too.

Why it is urgent: it is already being exploited

This is not a theoretical bug waiting for a proof of concept. CISA added CVE-2026-46300 to its Known Exploited Vulnerabilities (KEV) catalogue on 28 October 2026, which means it has been observed in real attacks. US federal agencies were given until 31 October 2026 to remediate, and CISA's required action is to apply mitigations in line with vendor instructions, under its risk-based patching guidance, and to discontinue use of the product where no mitigation exists.

The severity for a business is not only the CVSS number. According to CISA, the flaw can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root. A webshell on a web server is a persistent back door: it survives plugin updates, hides in the file system and gives an attacker a foothold to move data, alter orders or pivot into the rest of the network. There is no indication in the available data that this vulnerability has been used in ransomware campaigns, so treat that as unknown rather than ruled out. For a company bound by GDPR, root-level access to a server holding customer data is a potential personal data breach, with the notification obligations that follow.

What to do today

Find out what you are running. Check the kernel version on every server, VM and container host, and ask your hosting provider which kernel and patch level they operate. Compare against the ranges above; older LTS branches are affected too.
Apply the vendor update. The kernel project has published patches for this issue. Use the kernel build supplied by your distribution or provider and follow the instructions in the manufacturer's advisory; do not assume a specific fixed version beyond what that advisory states. Plan the reboot, because a kernel update only takes effect after one.
Look for signs of intrusion. Review web roots for unexpected PHP files, check for processes or cron entries you did not create, audit recent privilege escalation and outbound connections, and compare file integrity against a known-good baseline.
Reduce what is exposed. Close management panels, SSH and database ports to the public internet, restrict them by IP or VPN, and keep the web-facing stack to the minimum necessary. Less exposure means fewer paths to reach the vulnerable code.

How a cybersecurity team like ALMC's can help

Patching a kernel across a fleet of servers is straightforward in theory and awkward in practice when you have a small IT team, a live ecommerce site and no maintenance window that anyone is happy with. That is the kind of work ALMC does for SMEs and online shops across Catalonia: security audits and pentesting to map what is actually exposed, hardening of servers and of WordPress, PrestaShop and Joomla installations, monitoring and incident response when something looks wrong, and repair of websites that have already been hacked. In a case like CVE-2026-46300, the useful sequence is to identify every affected host, coordinate the update and reboot with minimal disruption, and then verify that no webshell or unauthorised access survived the patch. Detection and closure of vulnerabilities before they are exploited is the whole point; here, the exploitation has already started.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.