How do I know if my distribution has shipped the fix?

Search your kernel package changelog for the CVE ID, using `rpm -q --changelog kernel` or `apt changelog`. Also check your vendor's security tracker for CVE-2026-46300. After updating, reboot and confirm the new version with `uname -r`.

Does turning off IPsec remove the risk?

The described path runs through ESP input, so a host that does not use IPsec has less exposure along that route. It is not a replacement for the kernel update. Patch anyway and treat any module changes as a temporary measure you verify with your vendor.

What is the CISA deadline for CVE-2026-46300?

CISA added it to KEV on 2026-10-28 with a federal due date of 2026-10-31. Private organizations are not bound by it, but it is a useful target. CISA also expects you to follow BOD 26-04 and its Forensics Triage Requirements.

What should I check if I suspect a host was already abused?

Snapshot the disk and save logs first. Then look for unfamiliar PHP files in your web root, unexpected root-owned processes and odd logins. Escalate to your incident response process if you find any of them.

CVE-2026-46300 Linux Kernel Vulnerability: What to Do

Q: Can someone exploit CVE-2026-46300 remotely on its own?

NVD rates the attack vector as local, so the flaw alone needs access to the machine. CISA notes it can be chained with CVE-2026-109618 and CVE-2026-109619 to plant PHP webshells and run commands as root. That makes internet-facing web servers the main concern.

CVE-2026-46300 is a Linux kernel bug that can let encrypted network data be decrypted in place over page-cache-backed memory. CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on 2026-10-28, with a federal due date of 2026-10-31. Plan to patch your kernels now.

What happened

The flaw is in the kernel networking code. The function skb_try_coalesce() can attach paged fragments from one socket buffer (@from) to another (@to). If @from has SKBFL_SHARED_FRAG set, those fragments may be externally owned or backed by the page cache. Before the fix, the marker was lost on the resulting buffer.

That breaks a rule that later code relies on. ESP input calls skb_has_shared_frag() to decide whether an uncloned, nonlinear buffer can skip skb_cow_data(). If TCP receive coalescing had moved shared fragments into an unmarked buffer, ESP saw "not shared" and decrypted in place over page-cache-backed data.

The fix propagates SKBFL_SHARED_FRAG whenever skb_try_coalesce() transfers paged frags. The tailroom copy path does not need it, because it copies bytes into the linear data. Details are in the NVD record and the upstream stable patch.

Who is affected

Treat any Linux kernel without this fix as affected until your distribution says otherwise. The code path involves ESP (IPsec) input, so hosts that terminate IPsec deserve a closer look first. NVD lists eight stable-tree patch commits, so your vendor's kernel package is the place to confirm the fixed build.

Use this table to set your order of work.

Host type	Priority	First action
Internet-facing web server running PHP	Highest	Patch, then hunt for webshells
Host terminating IPsec/ESP	High	Patch, confirm `esp4`/`esp6` usage
Shared hosts with many local users	High	Patch, review local accounts
Single-user internal machine	Normal	Patch in the next cycle

CISA's guidance also tells stakeholders to evaluate each asset's internet exposure.

How serious is it, and is it exploited?

NVD scores it 7.8 HIGH with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. In plain terms, the attacker needs local access and a low-privilege account, but no user interaction. Listed weaknesses are CWE-787, CWE-456 and CWE-123.

The KEV listing is the real signal. CISA says this bug can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root. Our post on CVE-2026-109619 in PHP covers the PHP side of that chain. Known ransomware use is listed as Unknown.

What to do now

CISA's required action is to apply vendor mitigations under BOD 26-04 and follow its Forensics Triage Requirements. For cloud services, follow the BOD 26-04 guidance, or stop using the product if mitigations are unavailable.

Record the running kernel on each host.
Install your distribution's kernel update that references CVE-2026-46300.
Reboot into the new kernel, or use your vendor's live-patch service if it covers this CVE.
Check for signs of earlier compromise.

Check the kernel and whether the fix is listed in your package changelog:

uname -r

# RPM-based systems (RHEL, Fedora, SUSE)
rpm -q --changelog kernel | grep -i CVE-2026-46300

# Debian and Ubuntu
apt changelog linux-image-$(uname -r) | grep -i CVE-2026-46300

See whether the host handles ESP traffic at all:

lsmod | grep -E '^(esp4|esp6)'
ip xfrm state
ip xfrm policy

If ip xfrm state is empty and the modules are not loaded, the host is not actively using IPsec. That lowers urgency but does not replace patching. The kernel fix is the mitigation to rely on, so confirm any stopgap with your vendor.

Worked example: a PHP web server

Say you run a public PHP site on a Linux VM. Patch and reboot first. Then look for PHP files that changed recently and for root-owned processes that do not belong:

find /var/www -type f -name '*.php' -mtime -30 -ls
ps -eo user,pid,ppid,etime,cmd --sort=start_time | grep -E 'php|sh -c' | head -50
last -n 20

Any PHP file you did not deploy is a red flag. Preserve logs and a disk snapshot before you clean anything, so forensic triage is still possible.

What learners can take from this

This bug shows how one lost flag in a low-level function can break a safety check far away in another subsystem. It also shows why chained vulnerabilities matter: a medium-looking local flaw becomes root when paired with a web-facing bug. If you want to practice kernel updates, module checks and log review, the CompTIA Linux+ XK0-005 voucher fits well. Our Security+ study guide covers the vulnerability-management basics.

Start with the patch check above, then work through your web servers.