1. Executive summary
CVE-2026-46300 is a missing-initialization flaw in the Linux kernel (CVSS 7.8 HIGH, CWE-787 out-of-bounds write and CWE-456) that lets an attacker modify page-cache-backed data by failing to preserve the shared-fragment marker during socket buffer coalescing, so ESP input processing decrypts shared fragments in place. It is not in CISA KEV and EPSS sits at 10%, so exploitation is plausible but not yet observed at scale. The risk to EMEA financial services is the chain: the source states CVE-2026-46300 can be combined with CVE-2026-109618 and CVE-2026-109619 (both CVSS 9.2 CRITICAL, both in CISA KEV since 2026-10-26, both EPSS 100%) to implant PHP webshells and run commands as root. Any internet-facing Linux host running IPsec ESP processing is the exposure surface, and the two KEV entries in the chain are already being exploited.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 17 | The chain implants PHP webshells and runs commands as root on Linux hosts, which is an ICT-related incident the firm must detect and manage through a defined process. | Confirm the incident management process covers kernel-level root compromise and webshell detection on Linux estates, not only application-layer incidents. |
| DORA Art. 18 | Root-level compromise via a chained kernel flaw is a cyber threat the firm must classify against its own criteria. | Classify any confirmed CVE-2026-46300 chain exploitation against the firm's incident classification thresholds. |
| NIS2 Art. 21(2)(d) | The exposure depends on the Linux kernel and IPsec stack the firm sources from third parties, so supply chain security measures apply to how those components are patched. | Verify kernel and IPsec component patch provenance from vendors and confirm the update path is contractually and operationally in place. |
3. Technical analysis & attack chain
The flaw is a missing initialization of a variable in the Linux kernel. During socket buffer coalescing the kernel fails to preserve the shared-fragment marker, and ESP input processing then decrypts shared fragments in place. The result is unintended modification of page-cache-backed data. That is the primitive: an attacker who can drive ESP input processing against a vulnerable host can corrupt page-cache-backed data the kernel later serves.
The source describes the chain in three confirmed steps:
- Trigger CVE-2026-46300 to modify page-cache-backed data through the ESP shared-fragment handling failure.
- Chain with CVE-2026-109618 and CVE-2026-109619, both use-after-free flaws (CWE-416, CWE-755) rated CVSS 9.2 CRITICAL and both in CISA KEV since 2026-10-26.
- Use the combined primitive to implant PHP webshells and run commands as root.
The source does not give the initial access vector, the specific kernel versions affected, the IPsec configuration required, the webshell filename or content, persistence mechanism, command-and-control, lateral movement, or exfiltration detail. Those specifics are absent and should not be assumed. What the source does establish is the impact: root-level command execution and PHP webshell implantation on the host.
The two chained CVEs carry EPSS 100% and KEV status, which means exploitation of those components is confirmed in the wild independent of CVE-2026-46300. CVE-2026-46300 itself is not in KEV and EPSS is 10%, so the standalone flaw is not yet confirmed exploited at scale. The chain risk is what matters: a host missing the CVE-2026-109618 and CVE-2026-109619 fixes is already exposed to exploited use-after-free flaws, and CVE-2026-46300 adds a path to page-cache modification on top.
The source's required action references CISA BOD 26-04 and CISA Forensics Triage Requirements and sets a due date of 2026-10-31. That due date is the source's own remediation deadline, not a CISA KEV remediation due date; CVE-2026-46300 is not in KEV. Known ransomware campaign use is recorded as unknown.
4. Mitigation & containment
P1 within 24h
- Patch CVE-2026-109618 and CVE-2026-109619 first. Both are CVSS 9.2 CRITICAL, in CISA KEV since 2026-10-26, EPSS 100%. Apply the vendor kernel update that carries the use-after-free fixes to every Linux host, prioritising internet-facing systems that terminate or process IPsec ESP traffic.
- Identify hosts running IPsec ESP processing and treat them as the priority patch population for CVE-2026-46300. The source does not name affected kernel versions, so confirm the fixed version against the distribution or kernel vendor advisory before scheduling.
- Hunt for PHP webshells on any host that processes ESP traffic and has not received the CVE-2026-109618 and CVE-2026-109619 fixes. The source does not give webshell filenames or signatures; search web-accessible directories for recently created or modified PHP files and review for unexpected command execution.
P2 within 72h
- Apply the CVE-2026-46300 kernel update once the vendor fix is confirmed for the running kernel. The source's required action is to apply mitigations per vendor instructions and comply with CISA BOD 26-04; where mitigations are unavailable, BOD 26-04 guidance for cloud services applies or the product should be discontinued.
- Where a kernel update cannot be applied immediately, reduce exposure of ESP input processing on affected hosts (restrict which peers can send ESP traffic, or disable IPsec on hosts that do not need it) until the patch lands.
P3 within 7 days
- Review kernel patch cadence against the source's 2026-10-31 due date and confirm the estate can meet it. Where it cannot, record the exception and the compensating controls.
- Confirm forensic triage capability per the CISA Forensics Triage Requirements the source cites, so a suspected root compromise can be triaged without rebuilding blind.
5. Indicators of compromise
No indicators of compromise available in the source material.
The source describes behaviours but no atomic indicators (no hashes, filenames, paths, or network values). Behavioural indicators follow.
Behavioural indicators
| behaviour | where to observe | confidence |
|---|---|---|
| PHP webshell implanted on a Linux host following kernel exploitation | Web-accessible directories, web server logs, file integrity monitoring | Medium (single source, no filename given) |
| Commands executed as root outside normal administrative patterns | Process accounting, auditd, EDR process telemetry | Medium (single source) |
| Unexpected modification of page-cache-backed data | Kernel logs, file integrity monitoring on served content | Low (mechanism described, no observable signature given) |
6. Detection
Insufficient indicators to author detection rules.
The source gives no distinctive strings, command-line flags, mutex names, scheduled-task or service names, file names or paths, registry keys, or hard-coded values. A rule built on the CVE identifiers or product names would detect reporting about the flaw, not the flaw itself. Detection should instead rely on the behavioural indicators in §5: webshell hunting in web-accessible directories, root command execution review, and file integrity monitoring on page-cache-served content.
CVE assessment
3 referenced CVEs — 2 actively exploited (CISA KEV), 2 critical (CVSS ≥ 9.0)
| CVE | CVSS | Exploited | EPSS | Summary |
|---|---|---|---|---|
| CVE-2026-109618 | 9.2 Critical | ⚠ KEV 2026-10-26 | 100% | PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts… |
| CVE-2026-109619 | 9.2 Critical | ⚠ KEV 2026-10-26 | 100% | PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly… |
| CVE-2026-46300 | 7.8 High | — | 10% | In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing… |
7. Sources
- NVD, "CVE-2026-46300 Detail", https://nvd.nist.gov/vuln/detail/CVE-2026-46300, published 2026-10-28.
8. Adverse Trace position
Adverse Trace assesses CVE-2026-46300 as CVSS 7.8 HIGH, not in CISA KEV, EPSS 10%: a real but not yet widely exploited kernel flaw whose danger comes from the chain. The two chained CVEs, CVE-2026-109618 and CVE-2026-109619, are CVSS 9.2 CRITICAL, in CISA KEV since 2026-10-26, EPSS 100%, and those are the components to patch first. Client impact is root-level compromise and PHP webshell implantation on Linux hosts that process IPsec ESP traffic, with the source's own remediation due date of 2026-10-31. The technical detail in this advisory rests on a single source (NVD); the affected kernel versions, webshell artefacts, and initial access vector are not given and must be confirmed against the distribution or kernel vendor advisory before enforcement. Adverse Trace will track the vendor fix and any KEV status change for CVE-2026-46300 and update this advisory if either changes.
Published via PulseTrace — Adverse Trace threat intelligence.