CISA KEV adds CVE-2026-46300: patch Linux kernel packages and reboot safely

CVE: CVE-2026-46300 Product: Linux kernel Affected / fixed upstream stable versions: 3.9 through the branches before 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33 and 7.0.10; fixed in 7.1. Distribution kernels use their own package versions. CVSS: 7.8 HIGH, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS: not used for this priority decision; check the dated FIRST EPSS record before changing prioritisation. Exploitation: Confirmed — CISA added this CVE to KEV on 28 October 2026. CISA does not publish a public exploit narrative. CISA KEV: Yes, added 28 October 2026. Author urgency: Patch managed Linux hosts promptly. The reported path is local, but CISA’s exploitation confirmation makes this a priority for multi-user hosts, build runners, VPN gateways and hosts that run untrusted workloads.

CVE publication date: 23 May 2026. This is not a new CVE today; the new development is CISA adding it to KEV on 28 October 2026.

CVE-2026-46300 is a Linux kernel flaw in network-buffer coalescing. The CVE Program says a shared-fragment marker can be lost, allowing in-place ESP decryption to overwrite page-cache-backed fragments. The CVSS assessment is local and requires low privileges. That is not evidence that an unauthenticated internet user can reach every Linux host. CISA nevertheless now records exploitation in the wild. Remove the vulnerable kernel from service; do not run proof-of-concept code.

Are you affected?

Confirmed. Upstream identifies affected releases from 3.9, with stable fixes in 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10 and 7.1. The vulnerable condition concerns networking and IPsec/ESP handling.

Not confirmed. CISA confirms exploitation, but does not say which distributions, configurations or organisations were targeted. A host with an older upstream-looking kernel is potentially affected; that neither proves exploitation nor proves the relevant path is enabled.

Safe exposure check

On each host you administer, record the running kernel and operating system:

uname -r
cat /etc/os-release

Expected result: a kernel release and OS identification. Compare the installed vendor package with your distribution advisory, not only the upstream version string. Vendors often backport fixes.

For Debian and Ubuntu:

apt-cache policy linux-image-generic linux-image-amd64
dpkg -l 'linux-image*' | awk '/^ii/{print $2, $3}'

For RHEL-family systems:

rpm -q kernel kernel-core
dnf updateinfo info --cves CVE-2026-46300

For SUSE:

zypper lp --cve CVE-2026-46300
rpm -q kernel-default

Interpretation: an advisory explicitly marking the installed package fixed is evidence of remediation. A missing advisory is not proof of safety; escalate to the distribution support channel.

Optional external check, only for a hostname you own: use NetTools.tech DNS Lookup with the public hostname. It confirms the DNS destination you intend to maintain. It cannot identify a kernel, IPsec configuration, package version or CVE exposure; it is not an exposure verdict.

Patch first

Debian / Ubuntu

Prerequisites: console or out-of-band access, a current backup or snapshot, an approved maintenance window, and free space in /boot.

1. Refresh metadata and inspect the planned change:

   sudo apt update
   apt list --upgradable 2>/dev/null | grep -E 'linux-(image|headers)'
   

   Expected result: a new vendor kernel image or meta-package is listed.

2. Install the vendor-supported update:

   sudo apt full-upgrade
   

3. Reboot during the agreed window:

   sudo reboot
   

4. Validate after reconnecting:

   uname -r
   journalctl -b -p warning..alert
   

   Expected result: the running release is the new vendor kernel and there are no unexpected boot errors.

RHEL, Rocky, AlmaLinux and Fedora

Prerequisites: as above. For a clustered host, drain workloads under the platform runbook first.

sudo dnf update --security
sudo dnf updateinfo info --cves CVE-2026-46300
sudo reboot
uname -r

Expected result: the rebooted host runs the kernel package marked fixed by the vendor advisory. On subscription-managed RHEL, the vendor affected-package statement is authoritative: the CVE record lists fixed RHEL package builds, but entitlement and stream matter.

Container and appliance hosts

Updating a container image does not update the host kernel. Patch and reboot the node, then check node version and workload health. For cloud appliances or managed Kubernetes, use the provider’s supported node-image or maintenance workflow; do not install a generic upstream kernel onto a vendor appliance.

Temporary risk reduction and containment

There is no vendor-supported workaround in the CISA entry. Do not disable IPsec or networking blindly: that can create a larger outage or remove an important security control.

Until the planned reboot, reduce opportunity rather than claiming a fix:

• restrict interactive shell access to necessary administrators;
• remove unneeded local accounts and review privileged workload access;
• keep untrusted builds and tenant workloads off sensitive hosts where feasible;
• preserve logs and record the running kernel before maintenance.

If compromise is suspected, isolate the host under the incident process, preserve authorised volatile evidence, and engage incident response before rebuilding. A version match is not an incident finding.

Validate and retain a rollback path

Before patching, identify the current kernel and confirm the bootloader retains it. After the update, check the running kernel, application health checks and monitoring for failed services. Record the package version, reboot time and validation result in the change ticket.

If the new kernel causes a documented operational failure, boot the previous known-good kernel from the console or approved out-of-band interface, restore service, and contact the distribution or platform vendor. Rollback returns the host to a potentially vulnerable state: retain compensating controls and schedule a supported fixed kernel.

Timeline

• 23 May 2026: Linux published CVE-2026-46300.
• 28 October 2026: CISA added CVE-2026-46300 to KEV, confirming known exploitation.
• 29 October 2026: this guidance reviewed the CVE record, upstream stable fixes and CISA status.

References

1. CVE Program record — CVE-2026-46300
2. CISA Known Exploited Vulnerabilities catalogue
3. Linux stable fix reference
4. NVD — CVE-2026-46300
5. FIRST EPSS API — CVE-2026-46300

Change log

• 29 October 2026 — r1: Initial publication after CISA KEV addition; CVE publication date and KEV addition date stated separately.