Zero Radar
← feed
CriticalVulnerabilityCVE-2026-46300updated 29 Oct 2026, 04:19 UTC

Linux kernel flaw lets attackers alter cached file data and gain root

A bug in the Linux operating system's core can let an attacker quietly change data that the system treats as trusted, and chained with other flaws it can give them full control of the server. Attackers are already using it.

Exploited (CISA KEV, NVD)Fix availableOfficial, 4 sources
SeverityCriticalCVSS 7.8 of 10
Being exploited?YesConfirmed by CISA KEV, NVD · 28 Oct 2026
Fix available?Yes5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10 (and later) · since 28 Oct 2026
How sure is this?Official, 4 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sends trafficCrafted network packets reach the host
  2. 2Kernel coalesces buffersShared-fragment marker is lost
  3. 3ESP decrypts in placePage-cache data is modified directly
  4. 4Webshell implantedPHP webshell written via chained flaws
  5. ResultAttacker runs commands as root

What happened

Linux kernel socket-buffer coalescing drops the shared-fragment marker, so ESP input processing can decrypt page-cache-backed fragments in place, modifying data that should be read-only.

Why it is dangerous: Attackers can overwrite file content held in memory and, chained with CVE-2026-109618 and CVE-2026-109619, implant PHP webshells and run commands as root. Servers that are internet-exposed and running affected kernels are most at risk.

Are you affected?

You are affected if you run a Linux kernel from 3.9.0 up to (but not including) the fixed version for your branch, such as earlier than 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, or 7.0.10.

Package / productAffected versionsFixed in
Kernel · linux>= 3.9.0, < 5.10.2575.10.257
Kernel · linux>= 5.11.0, < 5.15.2085.15.208
Kernel · linux>= 5.16.0, < 6.1.1746.1.174
Kernel · linux>= 6.2.0, < 6.6.1416.6.141
Kernel · linux>= 6.7.0, < 6.12.916.12.91
Kernel · linux>= 6.13.0, < 6.18.336.18.33
Kernel · linux>= 6.19.0, < 7.0.107.0.10

What to do

  1. Update the Linux kernel to the fixed version for your branch (for example 6.1.174 or later on the 6.1 line), then reboot
  2. Prioritize internet-facing servers and any host running PHP or web applications
  3. Check for unexpected PHP webshells or unknown processes running as root, since compromise may predate the patch
  4. Follow your cloud or distribution vendor's instructions if you cannot patch directly

Timeline

  1. 23 May 2026, 12:17 UTC
    Publicly disclosed
  2. 28 Oct 2026, 00:00 UTC
    Reported by CISA KEV · CISA KEV
  3. 28 Oct 2026, 19:47 UTC
    Picked up by Zero Radar
  4. 28 Oct 2026, 19:57 UTC
    OSV reported on it · OSV
  5. 28 Oct 2026, 19:57 UTC
    Fixed version published: Kernel 5.10.257, Kernel 5.15.208, Kernel 6.1.174 · OSV
  6. 28 Oct 2026, 19:57 UTC
    Fix: 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10 (or later in each branch)
  7. 28 Oct 2026, 20:27 UTC
    NVD reported on it · NVD
  8. 28 Oct 2026, 20:32 UTC
    CISA reported on it · CISA

Sources 4 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-46300
CVSS
7.8 / 10
Disclosed
23 May 2026, 12:17 UTC
On Zero Radar
28 Oct 2026, 19:47 UTC (158 days after disclosure)
Last change
29 Oct 2026, 04:19 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Linux kernel flaw lets attackers alter cached file data and gain root · Zero Radar