CVE-2026-46300 was published by NVD on May 23, 2026. It entered the CISA KEV catalog on October 28, five months later, with a deadline of October 31: three days.
On its own, it's a local Linux kernel flaw rated 7.8. What makes it urgent is one sentence in the KEV entry: it can be chained with CVE-2026-109618 and CVE-2026-109619 — the two PHP2Shell flaws published on October 21 — to implant PHP webshells and run commands as root.
Put simply: PHP2Shell gets code execution on the web server, CVE-2026-46300 gets root.
The Vulnerability
| Field | Value |
|---|---|
| CVE | CVE-2026-46300 |
| CVSS 3.1 (NVD) | 7.8 (HIGH) — AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| Type | Out-of-bounds write (CWE-787), missing initialization (CWE-456), write-what-where condition (CWE-123) |
| Subsystem | Networking: skbuff (TCP coalescing) and ESP (IPsec) receive |
| NVD status | Undergoing Analysis |
| NVD publication | 2026-05-23 |
| Added to CISA KEV | 2026-10-28 |
| CISA deadline | 2026-10-31 |
Two other sources publish the same score and vector as NVD.
NVD description (excerpt):
skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost.
How It Works
The kernel represents a network packet as an sk_buff. Its data can point to pages it doesn't own — for instance pages from the page cache, the in-memory copy of files on disk. A marker, SKBFL_SHARED_FRAG, flags those shared pages: nobody is supposed to write into them.
- On TCP receive,
skb_try_coalesce()merges packets and moves those shared pages across without copying the marker. - ESP processing (IPsec decryption) checks that marker to decide whether it can decrypt in place.
- Marker lost: ESP decrypts straight over page cache pages.
The KEV entry sums up the consequence: unintended modification of page-cache-backed data. Changing the page cache of a file you can only read means potentially changing what the system executes or reads as configuration. That's our reading, not something NVD spells out — but it matches the scenario CISA describes: a low-privileged local user, typically the web server account, gaining root.
Why AV:L Is No Comfort
A local flaw assumes the attacker already has a foothold. On an unpatched PHP web server, PHP2Shell provides exactly that foothold. Put the two links together and you get a remote chain to root, which CISA says is being exploited.
Affected Versions
| Branch | Affected versions (NVD) | First version outside the range |
|---|---|---|
| 3.9 → 5.10 | from 3.9 up to and including 5.10.257 | not given by NVD |
| 5.11 → 5.15 | 5.11 and later, before 5.15.208 | 5.15.208 |
| 5.16 → 6.1 | 5.16 and later, before 6.1.174 | 6.1.174 |
| 6.2 → 6.6 | 6.2 and later, before 6.6.141 | 6.6.141 |
| 6.7 → 6.12 | 6.7 and later, before 6.12.91 | 6.12.91 |
| 6.13 → 6.18 | 6.13 and later, before 6.18.33 | 6.18.33 |
| 6.19 → 7.0 | 6.19 and later, before 7.0.10 | 7.0.10 |
| 7.1 | 7.1-rc1 to 7.1-rc4 | — |
⚠️ These are upstream kernel bounds from NVD. They don't map one-to-one onto distribution kernels, which backport fixes under their own version numbers: go by your distribution's advisories. NVD cites many Red Hat errata (RHSA-2026:19521 onward) and two Siemens advisories (SSA-019113, SSA-082556) for industrial products that embed Linux.
5.10 and older: the NVD range runs up to and including 5.10.257, with no fixed version. The 5.4, 4.19 and older branches fall inside that range. Check with your distribution whether a backported fix exists.
Check the running version:
uname -r
Detection
- Find the servers exposed to the chain: PHP web servers not yet patched for PHP2Shell, running a kernel in the range above. Those come first.
- Webshells: recent
.phpfiles in web directories, especially upload folders - Root processes whose parent is the web server or PHP-FPM (
www-data,apache,nginx) - System binaries whose in-memory content no longer matches the disk: a page cache modification doesn't necessarily leave a trace on disk, and a reboot wipes it. That's an inference from the mechanism — before rebooting a suspect machine, consider a memory capture.
find /var/www -name "*.php" -newermt "2026-10-01"
ps -eo user,pid,ppid,cmd --forest | grep -B2 -A2 "php-fpm\|apache2\|httpd"
lsmod | grep -E "^esp4|^esp6"
Mitigation
1. Update the Kernel Before October 31
Install your distribution's fixed kernel, then reboot: a kernel that's installed but not running protects nothing. Live patching, if you have it, can cover the gap.
2. Patch PHP at the Same Time
Breaking either link breaks the chain CISA describes. But a server where PHP2Shell is still exploitable will get compromised some other way: both fixes go together.
3. If You Don't Use IPsec
The bug triggers in the ESP receive path. On a machine that doesn't use IPsec, blocking the esp4 and esp6 modules from loading likely shrinks the attack surface. It's a stopgap inferred from the description, not a fix: validate it against your setup.
4. Forensic Triage
The KEV entry points to directive BOD 26-04, which requires forensic triage. On a PHP web server left exposed since October 21, treat compromise as possible: hunt for webshells, review accounts and SSH keys, cron jobs and newly added services.
Why Continuous Monitoring of Your Kernels Matters
A local flaw rated 7.8, published in May, raised no alarm for most teams. Five months later, a PHP flaw turns it into a chain to root, and CISA gives three days. You need to know without digging which kernel runs on which server, and which of them host PHP.
With cveo.tech, inventory your servers with their kernel and components, and get an automatic alert whenever a CVE affecting them is published or enters the CISA KEV catalog.