Linux Kernel Flaw Lets Local Users Alter Shared File Data

On October 28, CISA listed the Linux kernel flaw CVE-2026-46300 in its Known Exploited Vulnerabilities catalog. The Linux kernel flaw lets a local user alter page-cache-backed data that other processes share. CISA says it can be chained with two PHP flaws to implant a webshell and execute commands as root. Linux operators with shared hosts, local users or workloads that run untrusted code have a kernel-patching and compromise-triage job now.

The action date in the KEV entry is October 31 for covered federal agencies. For everyone else, the useful first question is which running kernels carry the fix, especially on hosts where a low-privileged account can reach local networking features. CISA marks forensic triage as required for its covered remediation.

A local path to shared file data

The Linux CNA record scores the issue CVSS 3.1 7.8 with a local attack vector and low privileges. A file page held in the kernel’s page cache can also be used as a fragment of a socket buffer. The packet-processing path must remember that the fragment is shared before it writes into that buffer. Other processes can read the same cached file page, so a write there reaches beyond the attacker’s own packet.

The CNA describes a local page-splicing and loopback ESP path, including user and network namespaces. Its assessment says the “global page cache is still corrupted from there.” That is why an untrusted local workload deserves attention even when it sits in a namespace. The affected host’s actual kernel and the ability to run that local path matter more than whether a public service accepts ESP traffic.

The buffer loses its ownership marker

In net/core/skbuff.c, skb_try_coalesce() can move paged fragments from one socket buffer to another. Before the fix, the receiving buffer could lose SKBFL_SHARED_FRAG, the flag that says some fragments remain shared. ESP input consults skb_has_shared_frag() to decide whether it must use skb_cow_data() to make a private copy before decryption. With the marker gone, ESP can decrypt in place over a page-cache-backed fragment and change data other processes use.

The Linux CNA traces the shared-fragment condition to local page splicing and loopback ESP input, and notes that “NIC-received packets never carry SKBFL_SHARED_FRAG.” Its fix propagates the marker when coalescing transfers fragment descriptors; the separate tailroom path copies bytes into the destination buffer and needs no shared-fragment marker. The relevant fix belongs in the kernel’s fragment accounting, not an edge firewall rule.

CISA describes the kernel write as one part of a chain with CVE-2026-109618 and CVE-2026-109619. That combination reaches PHP webshell installation and root command execution in its KEV description. Treat the PHP conditions as separate exposure questions; the kernel issue itself is a local shared-memory write path.

Fixed kernels across maintained branches

The Linux CNA lists these first-fixed upstream kernels: 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10 and 7.1. Match the running kernel to its own release branch. Distribution kernels may carry a backport under a different release string, so use that distribution’s security advisory and installed kernel package to establish whether the fix is present. A package update waiting for a reboot leaves the old kernel running.

For a host that can run untrusted local code, schedule the applicable kernel update and reboot into it. While that change waits, restrict untrusted local sessions and namespace creation where the workload permits; this reduces access to the CNA’s described route rather than replacing the patch. Check shared application servers and build workers against the same running-kernel and local-access conditions, rather than assuming an external firewall addresses a local bug.

Verify the kernel actually booted

Record the installed kernel package, the active release from uname -r, and the distribution’s fixed-package advisory. After the maintenance reboot, compare the running release with the fixed release for that branch or the vendor’s documented backport. A successful package transaction alone is not this verification: the active kernel is the one serving workloads.

CISA’s entry calls for forensic triage. If a host may have been abused, preserve its relevant host evidence and investigate page-cache-backed file integrity and unexpected privileged execution before returning it to service. Use host evidence such as file integrity and unexpected privileged execution for that investigation; a quiet network log cannot clear this local path. Patch status answers whether the write path remains available. Host investigation answers what happened while it was available.