Linux Kernel Flaw Lets Local Users Alter Shared File Data

On October 28, CISA listed the exploited Linux kernel flaw CVE-2026-46300 in its Known Exploited Vulnerabilities catalog, with an October 31 action date for covered federal agencies. This Linux kernel bug lets a local user change page-cache-backed data shared with other processes. CISA says the issue can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and execute commands as root; the PHP conditions are separate from the kernel’s local access path.

When socket-buffer coalescing transfers a shared file-page fragment, an affected kernel can lose SKBFL_SHARED_FRAG. ESP input may then skip skb_cow_data() and decrypt into the shared page. The Linux CNA lists first-fixed upstream kernels 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10 and 7.1. Use your distribution’s advisory for backported fixes.

Prioritize Linux hosts that run untrusted local code. Install the relevant fixed kernel, reboot, then compare uname -r with the fixed branch release or vendor backport. Until the change window, restrict untrusted local sessions and namespace creation where feasible. For a suspected intrusion, preserve host evidence and investigate file integrity and privileged execution as part of CISA’s requested forensic triage. Use host evidence for that investigation: a quiet network log cannot clear a local write path.