Linux Kernel Missing Initialization of a Variable Vulnerability
Linux — Kernel
- Added to KEV catalog
- 28 October 2026
- Federal remediation due date
- 31 October 2026
- Weakness classification (CWE)
- CWE-456
AI Breakdown
What it is
This vulnerability in the Linux Kernel arises from an uninitialized or lost shared-fragment marker during network socket buffer coalescing, allowing network decryption processes to unintentionally overwrite cached system data in place. Attackers can chain this memory corruption flaw with CVE-2026-109618 and CVE-2026-109619 to drop PHP webshells and execute arbitrary commands with full root privileges. The issue allows unauthorized modification of sensitive system memory via network packet processing.
Why it matters
CISA has confirmed that this high-severity vulnerability is being actively exploited in the wild, enabling threat actors to achieve full administrative compromise of underlying Linux hosts. While its association with specific ransomware campaigns is currently unknown, the ability to obtain root access presents severe operational and security risks. Organizations must treat this as an urgent threat given active chaining attacks and strict federal remediation timelines.
Recommended action
Apply the relevant Linux kernel security updates and vendor mitigations immediately, prioritizing internet-exposed assets in accordance with CISA BOD 26-04 guidance. Perform required forensic triage across potentially exposed servers to verify that no webshells or root-level compromise have occurred. If vendor patches or mitigations are unavailable, follow cloud service guidance or isolate and discontinue use of the affected systems.
AI-generated from CISA and NVD data — treat as a starting point, not a substitute for your own risk assessment.
CISA Description
Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes
This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: ; https://git.kernel.org/stable/c/3599e6b3cc1ada96883d496a50a210d3afbb6987 ; https://git.kernel.org/stable/c/2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c ; https://git.kernel.org/stable/c/9d3e5fd19fe1063bf607219e8562fbd567b8e8d5 ; https://git.kernel.org/stable/c/78bf6b6bb19541d19fbda6242e7cfe2c682763c0 ; https://git.kernel.org/stable/c/760e1addc27ba1a7beb4a0a7e8b3e9ec49e7a34e ; https://git.kernel.org/stable/c/3bd9e113d50034db99d7ef69fd8e5242d15e414a ; https://git.kernel.org/stable/c/3884358a9286b17f389a72b1426fc4547c23c111 ; https://git.kernel.org/stable/c/f84eca5817390257cef78013d0112481c503b4a3 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-46300
NVD Technical Description
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.
More Linux Vulnerabilities
Linux Kernel Out-of-Bounds Write Vulnerability
Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability
Linux Kernel Race Condition Vulnerability
Linux Kernel Unspecified Vulnerability
Linux Kernel Out-of-Bounds Write Vulnerability
Is this vulnerability present in your environment?
CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.
Explore VAPT Services