CVE-2026-46300
Linux Kernel Missing Initialization of a Variable Vulnerability
HIGH / 高● 悪用確認済み（CISA KEV）
Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.
影響製品・バージョン
- linux linux kernel >= 3.9, <= 5.10.257
- linux linux kernel >= 5.11, < 5.15.208
- linux linux kernel >= 5.16, < 6.1.174
- linux linux kernel >= 6.2, < 6.6.141
- linux linux kernel >= 6.7, < 6.12.91
- linux linux kernel >= 6.13, < 6.18.33
- linux linux kernel >= 6.19, < 7.0.10
- linux linux kernel 7.1
- siemens simatic s7-1500 cpu 1518-4 pn\/dp mfp firmware >= 3.1.5, <= 3.1.6
- redhat openshift container platform >= 4.12, < 4.12.91
- redhat openshift container platform >= 4.13, < 4.13.67
- redhat openshift container platform >= 4.14, < 4.14.68
- redhat openshift container platform >= 4.15, < 4.15.65
- redhat openshift container platform >= 4.16, < 4.16.63
- redhat openshift container platform >= 4.17, < 4.17.55
- redhat openshift container platform >= 4.18, < 4.18.43
- redhat openshift container platform >= 4.19, < 4.19.33
- redhat openshift container platform >= 4.20, < 4.20.24
- redhat openshift container platform >= 4.21, < 4.21.17
- redhat enterprise linux 6.0
- redhat enterprise linux 7.0
- redhat enterprise linux 8.0
- redhat enterprise linux 9.0
- redhat enterprise linux 10.0
- redhat enterprise linux aus 8.4
- redhat enterprise linux aus 8.6
- redhat enterprise linux eus 8.4
- redhat enterprise linux eus 9.4
- redhat enterprise linux eus 9.6
- redhat enterprise linux eus 10.0
- redhat enterprise linux tus 8.6
- redhat enterprise linux tus 8.8
- redhat enterprise linux update services for sap solutions 8.6
- redhat enterprise linux update services for sap solutions 8.8
- redhat enterprise linux update services for sap solutions 9.0
- redhat enterprise linux update services for sap solutions 9.2
- redhat enterprise linux update services for sap solutions 9.4
修正バージョン
- 5.15.208
- 6.1.174
- 6.6.141
- 6.12.91
- 6.18.33
- 7.0.10
- 4.12.91
- 4.13.67
- 4.14.68
- 4.15.65
- 4.16.63
- 4.17.55
- 4.18.43
- 4.19.33
- 4.20.24
- 4.21.17
対応策
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
参考資料
- Known Exploited Vulnerabilities CatalogCISA公開日: 不明公的機関一次情報取得日: 2026-10-31
関連インシデント
この脆弱性に関連付けられた登録インシデントはありません。