Linux kernel flaw CVE-2026-46300 joins CISA's exploited list
CISA lists Linux kernel flaw CVE-2026-46300 as exploited and chainable with PHP bugs. See fixed kernels and how to check your servers.
TL;DR: CISA has added CVE-2026-46300, a Linux kernel flaw, to its exploited catalogue, and says it can be combined with two PHP bugs to plant a webshell and get root command execution. Patch the kernel and check the stable branch you run.
What happened
On October 28, 2026, CISA put CVE-2026-46300 into its Known Exploited Vulnerabilities catalogue, with a remediation due date of October 31, 2026. The bug sits in the kernel network stack: when two socket buffers are merged, a marker that flags shared memory pages is dropped. Later, the IPsec ESP receive path trusts the missing marker and decrypts data in place over memory that is backed by the page cache, so cached file contents can be changed unexpectedly.
CISA's entry adds that attackers can combine it with the PHP flaw CVE-2026-109618, together with CVE-2026-109619, to drop a webshell and then execute commands as the root user. We covered those two flaws in our PHP post. The National Vulnerability Database gives CVE-2026-46300 a CVSS v3.1 score of 7.8 (high), and tags it CWE-456 among other weaknesses.
The same database lists fixed stable kernels as 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33 and 7.0.10, and treats releases earlier than each of those in its branch as affected. Distribution kernels backport fixes under their own version numbers, so read your vendor's kernel notice.
Am I affected?
Any Linux server running a kernel from one of the affected branches is a candidate, and a host that also runs PHP applications is the case CISA describes. Check the running kernel and compare it with your distribution's notice:
uname -r
cat /etc/os-releaseInstalling a new kernel package is not enough: the machine must reboot into it. Containers share the host kernel, so patch the nodes, not just the images.
How to check with Stackurity
Stackurity's read-only agent reads installed packages on Linux servers, matches them against advisories every hour and the CISA catalogue every day, and respects distribution backports so patched kernels are not flagged. Fixes show as upgrade cards, and a fresh report after the reboot records whether the issue is gone. Stackurity does not cover appliance firmware, so rely on the vendor for that. See how remediation works, then start a free trial.
