CVE-2026-46300 — Exploited Linux kernel flaw can support PHP attack chains leading to root commands

75/100

CVE-2026-46300 permits unintended modification of page-cache-backed data through socket buffer coalescing and ESP input processing. CISA lists it as known exploited and states that it can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root. Check distribution and appliance supplier advisories for affected kernels, deployment prerequisites and fixed releases.

• Actively exploited (CISA KEV, added 2026-10-28)
• CVSS 7.8
• EPSS 10.2 %
• Linux
• CWE-456

Digest of 2026-10-29

Sources

• CISA — Known Exploited Vulnerabilities — CISA KEV — Linux Kernel Missing Initialization of a Variable Vulnerability (CVE-2026-46300)