CVE-2026-46300 in the Linux kernel, now on CISA's exploited list. Fixed distro versions and the update steps you need to take.
Most Linux servers process network traffic inside the kernel. During that work, the kernel can lose track of whether packet fragments are shared. CVE-2026-46300 is a flaw of exactly that kind. It was published in NVD in May 2026, but CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on October 28, 2026.
Short answer: CVE-2026-46300 is a Linux kernel flaw where a marker is lost while packets are being merged. NVD rates it CVSS 7.8 (high). An attacker needs local access to the server and a low-privilege account. CISA has confirmed it is being exploited. Update to the fixed kernel your distribution publishes, then reboot the server.
What happened?
Here is the problem. When the kernel merges incoming data, it moves fragments of one packet into another. If the source packet is marked as carrying shared fragments, which must not be modified in place, that marker is not copied to the destination. Later code can then assume the fragments are private and modify the data in place. NVD’s description says this shows up in the IPsec (ESP) receive path.
The KEV record classifies the weakness as CWE-456 (missing initialization of a variable). That label fits poorly, because the real bug is a flag that is not carried over. NVD also lists CWE-787 and CWE-123.
The flaw is old. NVD published it on May 23, 2026. But CISA has evidence it has been used in attacks, and it added the flaw to KEV on October 28, 2026. CISA’s KEV entry also says it can be chained with the PHP flaws CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root. For the PHP side, see the PHP memory corruption flaws post. So calling it “just a local bug, not urgent” would be a mistake.
Who is affected?
| Item | Details |
|---|---|
| CVE ID | CVE-2026-46300 |
| Product | Linux kernel |
| CVSS score and severity | 7.8, high (CVSS 3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) |
| Attack path | Local (AV:L): the attacker needs an account or a way to run code on the server |
| Weakness type (CWE) | CWE-456 (per the KEV record); NVD also lists CWE-787 and CWE-123 |
| NVD published | May 23, 2026 |
| Added to CISA KEV | October 28, 2026 |
| CISA due date | October 31, 2026 (already passed as of today) |
| Known ransomware use | Unknown (KEV record says “Unknown”) |
I could not confirm the full affected version range from NVD, so the table below shows which fixed version to update to:
| Distribution | Fixed package version |
|---|---|
| Ubuntu 22.04 LTS | 5.15.0-181.191 |
| Ubuntu 24.04 LTS | 6.8.0-124.124 |
| Ubuntu 26.04 LTS | 7.0.0-22.22 |
| Debian 12 (bookworm) | 6.1.190-1 (security) |
| Debian 13 (trixie) | 6.12.115-2 (security) |
| SUSE SLES 15 SP6 | 6.4.0-150600.23.109.1 |
| Red Hat (RHEL and derivatives) | No package version on the Red Hat CVE page; see bulletin RHSB-2026-003 |
If you build your own kernel, follow the fix commits in the stable branches on kernel.org.
What should you do?
- Check the running kernel with
uname -r. That is the version that is active now. A newer kernel may be installed but not yet booted, so check your package manager too. - Check your distribution’s security page for CVE-2026-46300: Ubuntu, Debian, SUSE, or Red Hat. If your running version is below the fixed version in the table above, update.
- Update the kernel package through your distribution’s package manager. On Debian and Ubuntu this usually means
sudo apt update && sudo apt upgrade. - Reboot the server. The new kernel does not take effect until the reboot. If you use live patching (livepatch), check that its security update is also applied.
- After the reboot, run
uname -ragain and confirm the new version. - Review local accounts on the server. On shared hosting or multi-user machines this flaw matters more. Disable accounts you do not need.
- If you cannot update right away, apply the workaround from your distribution’s advisory. Red Hat has published a mitigation procedure in bulletin RHSB-2026-003. Read the details in that bulletin.
- If you suspect a compromise, look at the logs first. Check web directories and system paths for files you do not recognize and for unusual changes. CISA also recommends forensic triage for this flaw. Capture evidence before you update, so it is not lost.
If you are setting up a server from scratch, the first 30 minutes on a Linux server guide covers the basic steps.
Frequently asked questions
Does this affect me?
If your kernel is older than the fixed version, yes. The risk is higher if several local accounts exist on the server or if untrusted users can run code there. For a definite answer, compare the output of uname -r with the fixed version in your distribution’s advisory.
CVSS says “local”. Can’t it be attacked from outside?
Not directly from the network. But a local flaw that works for someone with a user account still seriously weakens a server. The CVSS score alone does not measure risk. Active exploitation and the number of local users matter more for priority.
What if I cannot update right away?
Apply the workaround from your distribution’s advisory. For Red Hat, that is bulletin RHSB-2026-003. Reduce the number of local accounts and schedule the update at the earliest maintenance window. CISA’s due date has already passed, so waiting adds risk.
Sources
- NVD: CVE-2026-46300
- CISA Known Exploited Vulnerabilities Catalog
- Ubuntu security record: CVE-2026-46300
- Debian security tracker: CVE-2026-46300
- SUSE security record: CVE-2026-46300
- Red Hat security record: CVE-2026-46300
This article was prepared on November 6, 2026, based on CISA and NVD records. It will be updated if new information comes out. For server updates or security maintenance, you can reach me through the quote form.