SECURITY_THREAT_PULSE
LIVE
LAST UPDATED
FIRST SEEN
7 SOURCES ON THIS EVENT
▲ ACT NOWTODAYCVE-2026-46300 · CVSS 7.8

Linux Kernel: security flaw used in attacks

AFFECTSLinux KernelLinux

OFFICIAL NAME: Linux Kernel Missing Initialization of a Variable Vulnerability

WHAT IT IS · COMPUTERS, PHONES AND BROWSERSIt runs on staff computers, phones or browsers.

DO THIS FIRSTInstall the latest updates on every device, and turn on automatic updates. Not sure if you use it? Send this page to your IT provider or security lead and ask.

TECHNICAL SUMMARY Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place.

WHY THIS VERDICT Attacks are confirmed. The vulnerability is 171 days old, so many systems are likely still unpatched. Ready-made attack tools are public.

WHY IT RANKS HERE Exploitation is confirmed by an authoritative source. Ready-made attack tools are public. The confirmation is 14 days old.

HIGHEST CONFIRMED RUNG
EXPLOITED
CISA KEV
LISTED
EXPLOIT CODE
READY TO USE
// EVIDENCE LADDER

How far has it climbed?

CONFIRMED
REPORTED
NO EVIDENCE

  1. 01 TALK

    ■ CONFIRMED
    NEWEST EVIDENCE · 1 SOURCE

    CVE-2026-46300 discussed publicly (CIRCL sighting). CVE-2026-46300 discussed publicly (CIRCL sighting).

  2. 02 EXPOSED

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    We have no source that counts exposed systems yet. Internet scan data needs a partnership we do not have. No evidence here does not mean nothing is exposed.

  3. 03 TRIED

    ■ CONFIRMED
    NEWEST EVIDENCE · 2 INDEPENDENT SOURCES

    Attacks that worked are confirmed (step 4), so attempts count as confirmed too.

  4. 04 EXPLOITED

    ■ CONFIRMED
    NEWEST EVIDENCE · 2 INDEPENDENT SOURCES

    Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root. CISA Vulnrichment marks CVE-2026-46300 as actively exploited.

  5. 05 DAMAGE

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    Breach notices and filings rarely name the flaw that was used, so we cannot link them to this event yet. No evidence here does not mean no harm.

// THE CLOCK

When each thing happened

  1. DISCLOSED
    CVE-2026-46300 published
  2. EXPLOIT CODE PUBLIC
    Exploit-DB
  3. FIRST ATTACK REPORT
    CISA Known Exploited Vulnerabilities
  4. CISA KEV LISTING
    CISA KEV listing
  5. US FEDERAL DEADLINE
    CISA deadline for US federal agencies
Attacks were reported 158 days after disclosure. CISA listed it 158 days after disclosure.

THE FIX

CISA's instruction: apply the vendor's fix, or stop using the product if no fix exists. The deadline CISA set for US federal agencies, Oct 31, 2026, has passed. It is a US government deadline; use it as a guide.

// ASK YOUR TEAM

Questions to ask this week

// TIMELINE · PACIFIC TIME

How it unfolded

  1. MAY 13, 2026
    Metasploit exploit module: Fragnesia LPE (CVE-2026-46300)
  2. MAY 14, 2026
    15 public GitHub repositories claim a proof of concept for CVE-2026-46300
  3. Attack activity. MAY 23, 2026
    CISA Vulnrichment marks CVE-2026-46300 as actively exploited
  4. MAY 28, 2026
    Exploit-DB entry: Linux Kernel - Local Privilege Escalation
  5. Attack activity. OCT 27, 2026
    Linux Kernel Missing Initialization of a Variable Vulnerability
  6. OCT 28, 2026
    CVE-2026-46300 discussed publicly (CIRCL sighting) (55 reports, latest NOV 4)

SOURCES

  1. [1] CIRCL Vulnerability-Lookup sightings: CVE-2026-46300 discussed publicly (CIRCL sighting), NOV 4
  2. [2] CISA Known Exploited Vulnerabilities: Linux Kernel Missing Initialization of a Variable Vulnerability, OCT 27
  3. [3] Exploit-DB: Exploit-DB entry: Linux Kernel - Local Privilege Escalation, MAY 28
  4. [4] CVE List V5 and CISA Vulnrichment: CISA Vulnrichment marks CVE-2026-46300 as actively exploited, MAY 23
  5. [5] PoC-in-GitHub: 15 public GitHub repositories claim a proof of concept for CVE-2026-46300, MAY 14
  6. [6] Metasploit module metadata: Metasploit exploit module: Fragnesia LPE (CVE-2026-46300), MAY 13
  7. [7] CIRCL Vulnerability-Lookup sightings: 54 more reports