What happened
A vulnerability tracked as CVE-2026-46300 has been fixed in the Linux kernel, the lowest layer of the operating system that manages memory, processes and networking. The bug sits in the code that handles incoming network packets. The NVD entry was published on May 23, 2026, and fixes have been merged into the stable kernel branches on kernel.org.
On October 28, 2026, the US agency CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog under the name “Linux Kernel Missing Initialization of a Variable Vulnerability”. The EU Vulnerability Database (EUVD), run by ENISA, also lists it as exploited since October 28, 2026, under the ID EUVD-2026-31535. CISA has not yet said whether ransomware groups are using it.
Why it is dangerous
When handling network traffic, the kernel sometimes merges small chunks of data into larger ones to save work. Some of those memory chunks are only “borrowed”, for example they belong to the file cache (page cache), and carry a marker saying they must not be written to directly. During merging, that marker was lost. According to the fix description, decrypting IPsec traffic could then write straight into memory that belongs to files.
Think of it like this: a borrowed original contract is stamped “original, do not write here”. A clerk staples it together with other papers, the stamp gets lost, and a colleague then scribbles notes directly onto the original. The flaw is classified as an out-of-bounds write (CWE-787), a write-what-where condition (CWE-123) and a missing initialization (CWE-456).
The CVSS severity score is 7.8 out of 10, which is high. It was assigned not by NVD itself but by the organization that registered the CVE. According to that rating, the attack requires local access and regular user privileges, needs no action from a victim, and has a high impact on confidentiality, integrity and availability. So the attack does not work directly over the internet, but an attacker can use it as a next step after getting in, for example through a vulnerable web application. Neither the fix description nor CISA says exactly what an attacker can achieve with it.
The CISA KEV catalog only lists flaws with confirmed real-world exploitation. EPSS estimates the probability that a flaw will be exploited in the next 30 days. As of October 28, 2026, it stands at 10.2%, higher than for 95.7% of all known vulnerabilities.
Who is affected
This concerns Linux systems whose kernel does not yet include the fix. Exact affected kernel version ranges have not been published yet, and CISA notes that the flaw is in a component that may be used by different products. What matters is whether your distribution (for example Debian, Ubuntu, Red Hat or SUSE) has already released a fixed kernel.
The risk is highest where several people have access to the system or where third-party code runs:
- shared web hosting and servers with many user accounts
- container hosts (Docker, Kubernetes), because containers share the host’s kernel
- VPS and cloud servers running web applications an attacker could use to get in
- Linux servers and gateways that use IPsec encryption
The fix description uses IPsec processing as its example. It does not say whether other exploitation paths exist, so do not delay patching on systems without IPsec.
How to check if you are affected
All of the commands below only read information and change nothing. First, find out which kernel version is running and which distribution you have:
uname -r
cat /etc/os-releaseThen check whether the running kernel’s package includes the fix for this CVE. On Red Hat, AlmaLinux and Rocky Linux:
rpm -q --changelog kernel-$(uname -r) | grep CVE-2026-46300On Ubuntu (shows the changelog of the running kernel’s modules package, which lists CVE IDs):
apt changelog linux-modules-$(uname -r) | grep CVE-2026-46300On Debian, the kernel package changelog does not reliably list CVE IDs. List the installed kernel packages and compare their version with the status of CVE-2026-46300 in the Debian security tracker (security-tracker.debian.org):
dpkg -l 'linux-image*' | grep ^iiIf nothing comes back, search for CVE-2026-46300 in your distribution’s security tracker. To see whether the system uses IPsec, run sudo ip xfrm state. Empty output means no IPsec connections are active.
How to fix it
Fixes have been merged into the stable kernel branches on kernel.org, but specific fixed version numbers have not been published yet. For a typical company, the right path is the updated kernel from your distribution vendor. CISA gave US federal agencies until October 31, 2026, to remediate, just three days after adding the flaw to its catalog.
- List which servers run Linux, including container hosts, virtual servers and Linux-based appliances.
- Install the updated kernel from your distribution’s official repositories, for example with
sudo apt update && sudo apt upgradeorsudo dnf update kernel. - Reboot the server. The new kernel only takes effect after a reboot, or through live patching if your distribution offers it.
- After rebooting, confirm with
uname -rthat the new version is running. - For devices where you do not update the kernel yourself (NAS, firewalls, appliances), watch the vendor’s security advisories.
Order of work: first internet-facing servers with multiple users or web applications, then container hosts and VPN gateways, and finally internal servers. No official temporary workaround has been published. Until you patch, restrict SSH access to your servers and remove unneeded accounts.
What if you may already be compromised
No specific indicators of compromise, such as suspicious files or IP addresses, have been published yet. Since the attack assumes access to the system, look for signs of how an attacker got in and what they did after gaining higher privileges:
- unknown accounts in
/etc/passwdand unexpected changes in/etc/sudoersor/etc/sudoers.d/ - unusual logins in the output of
lastand in/var/log/auth.logor/var/log/secure - new SSH keys in
authorized_keysfiles, especially for root - unexpected crashes and kernel errors in
journalctl -kordmesg - modified system files (check with
rpm -Vaordebsums) - unknown processes, cron jobs and services
For this flaw, CISA also points to its forensic triage requirements. If you find anything suspicious, do not blindly reboot or patch the server, as that can destroy evidence. Disconnect it from the network and bring in an incident response specialist.