[悪用確認] CVE-2026-46300: Linux Kernel Missing Initialization of a Variable Vulnerability
Linux Kernel Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-31)
CISA Known Exploited Vulnerabilities에서 읽기
VulnPulse 해설
Linux kernel "Fragnesia" joins CISA KEV: a local root bug reported chained with the PHP2Shell flaws
CISA added CVE-2026-46300 to its Known Exploited Vulnerabilities list on 2026-10-28. The kernel bug lets an ordinary local user change the in-memory copy of read-only files and become root.
영향을 받는 대상
Servers, VMs and container hosts running Linux, plus appliances built on Linux. NVD's CPE data puts the fix boundaries at 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33 and 7.0.10; anything older in those branches is affected. Versions 3.9 through 5.10.257 are also listed as affected, with no fixed 5.10 release named. Distribution status from vendor pages: Red Hat ships fixes for RHEL 8, 9 and 10, and says RHEL 6 and 7 are not affected. Ubuntu has fixed kernels for 22.04, 24.04, 25.10 and 26.04; the default kernels of 20.04 and older are not affected (the 20.04 HWE 5.15 kernel gets a fix through Ubuntu Pro). Amazon published fixes for Amazon Linux 2 and Amazon Linux 2023 on 2026-05-15. Windows-only or macOS-only setups are not involved.
쉽게 말하면
Shared papers carry a sticky note saying "make a copy before writing on this". While the papers are being re-bundled, the note falls off, and the next clerk writes straight onto the original. If that original is the sheet that decides who may act as administrator, whoever edits it gets administrator rights.
작동 방식
When the kernel merges received packet data (skb_try_coalesce), it drops the flag (SKBFL_SHARED_FRAG) that says a fragment is shared with something else. The IPsec ESP receive path checks that flag to decide whether it may decrypt in place without making a copy, so once the flag is gone it decrypts directly over page-cache memory that holds file contents. Red Hat describes the result: a low-privileged local user can use the ESP-in-TCP path to place values of their choosing into cached copies of files they may only read, and from there reach root. Only the cached copy in memory changes; the file on disk stays the same. William Bowling of V12 found it; it was shared on oss-security on 2026-05-13 together with proof-of-concept code. It belongs to the same family as "Dirty Frag" and uses the same ESP path, but it is a separate bug with its own fix. NVD scores it 7.8 (local). On its own it cannot be fired over the network; the attacker first needs a way to run code on the host.
공격 흐름
- This sequence is from Dream Research's report of 2026-10-26. The attacker first used two PHP flaws, CVE-2026-109618 and CVE-2026-109619 (together called PHP2Shell), against the management web server of internet-facing firewalls, running commands with the web server's low privileges
- On the same device the attacker then used Fragnesia to alter the in-memory copy of the PAM settings for su, which let them become root without a password
- They left a web shell running as root so they could come back later
- CISA's KEV entry also says the bug can be combined with PHP2Shell so that an attacker ends up with a web shell and root-level command execution. Dream has not named the firewall vendor
해야 할 일
- Linux admins: check your distribution's advisory for a kernel that fixes CVE-2026-46300, install it and reboot. The Dirty Frag fix alone does not cover this, so check by CVE number rather than by "we patched in May"
- Admins who cannot update yet: consider the same workaround Ubuntu and others give for Dirty Frag, that is, stopping the esp4, esp6 and rxrpc kernel modules from being loaded. IPsec VPNs (strongSwan and similar) and AFS will stop working
- Teams exposing PHP: upgrade PHP to at least 8.2.35, 8.3.36, 8.4.27 or 8.5.12 depending on your branch. PHP 8.1 and older get no updates from the PHP project, so use a distribution fix or upgrade
- Owners of Linux-based firewalls and VPN boxes: ask the vendor where it stands on both PHP2Shell and CVE-2026-46300, and keep management interfaces off the internet
- Security teams: on Linux hosts that serve PHP publicly, look for unfamiliar PHP files in web directories, the contents of /etc/pam.d/su, and auto-start entries you do not recognize. A reboot clears in-memory tampering, but dropped files stay on disk and must be removed separately
- US federal agencies: CISA's deadline is 2026-10-31, and the KEV entry also requires forensic triage under BOD 26-04 for this CVE
아직 밝혀지지 않은 점
- The firewall vendor and versions that were targeted (Dream withheld them and says it notified the vendor)
- As far as VulnPulse could check, nothing published beyond Dream's report describes the same chain in detail. CISA listed the bug in KEV but has not released its evidence
- Use in ransomware is marked "Unknown" in KEV
- A fixed release for the 5.10 kernel branch (NVD's CPE data gives no boundary)
출처
- VulnPulse の元記事 (CISA KEV)
- CISA Known Exploited Vulnerabilities: CVE-2026-46300
- NVD: CVE-2026-46300
- Red Hat: CVE-2026-46300
- Ubuntu: CVE-2026-46300
- Ubuntu blog: Dirty Frag の回避策
- Amazon Linux Security Center: CVE-2026-46300
- oss-security (2026-05-13)
- PHP: セキュリティ告知 (2026-10-21)
- Dream Research (2026-10-26)
원문 기사와 공개 정보를 바탕으로 VulnPulse가 자체적으로 정리한 해설입니다. 정확한 내용은 출처를 확인하세요. 업데이트:
| CVE | CVE-2026-46300 |
|---|---|
| 정보원 | CISA Known Exploited Vulnerabilities |
| 수집 시각 | 2026. 10. 29. 오전 04:58 |
| 데이터 | Markdown JSON |
2026. 10. 29. 오전 04:58, CISA Known Exploited Vulnerabilities에서 "[悪用確認] CVE-2026-46300: Linux Kernel Missing Initialization of a Variable Vulnerability"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "긴급"(critical)입니다. 관련 기술: Linux, PHP. CVE: CVE-2026-46300.