{"status":"success","data":{"id":"CVE-2026-46300","slug":"cve-2026-46300-linux-kernel-page-cache-uninitialized-variable","title":"Linux Kernel Page-Cache Uninitialized Variable Data Corruption & Root LPE","summary":"Critical Linux Kernel memory management bug in socket buffer coalescing enabling local privilege escalation to root and remote container breakouts.","description":"Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. Can be chained for container escape and root shell acquisition.","severity":"HIGH","cvss_score":8.8,"cvss_version":"3.1","cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_metrics":{"scope":"CHANGED","integrity":"HIGH","attackVector":"LOCAL","availability":"HIGH","confidentiality":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","privilegesRequired":"LOW"},"epss_score":0.912,"epss_percentile":0.985,"cisa_kev":true,"cisa_date_added":"2026-10-28T00:00:00.000Z","cisa_due_date":"2026-10-31T00:00:00.000Z","ransomware_campaign":null,"threat_actors":["Lazarus Group","Cloud Breaker Crew"],"exploit_status":"active_wild","cwes":[{"id":"CWE-456","name":"Missing Initialization of a Variable"},{"id":"CWE-787","name":"Out-of-bounds Write"}],"affected_vendors":["Linux","Canonical (Ubuntu)","Red Hat","SUSE"],"affected_products":[{"cpe":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","vendor":"Linux","product":"Linux Kernel","fixed_version":"Linux 6.11.5 / 6.6.58 / 6.1.114","affected_versions":"Kernel 6.1 through 6.11.x before stable commits"}],"ai_analysis":{"sigma_rule":"title: Linux Kernel SKB Coalesce Exploit Detection\nstatus: high\nlogsource:\n  product: linux\n  service: auditd\ndetection:\n  selection:\n    syscall: 'socket'\n    proto: 'IPPROTO_ESP'\n  condition: selection","analyzed_at":"2026-10-28T14:00:00.000Z","model_provider":"Gemini 2.0 Flash Security Sentinel","executive_summary":"High-severity Linux Kernel vulnerability allowing local unprivileged users or compromised microservices in Kubernetes containers to corrupt read-only page caches and achieve instant root escalation.","detection_guidance":"Inspect kernel logs (`dmesg`) for memory allocation warnings in `skb_coalesce` or anomalies in IPSec crypto transforms.","mitigation_playbook":["Update kernel packages and reboot affected nodes: `apt update && apt dist-upgrade -y` or `dnf update kernel`.","Restrict unprivileged user namespaces and unprivileged networking socket creation where possible.","Utilize runtime security agents (e.g. Falco, Cilium Tetragon) to alert on anomalous kernel page cache modifications."],"technical_root_cause":"During socket buffer (skb) coalescing in the networking stack, uninitialized variables in the IPSec ESP handling path fail to preserve the shared-fragment marker. As a consequence, inbound packet decryption mutates memory buffers shared with the page cache, overwriting executable code or /etc/passwd in memory.","exploitation_mechanism":"An attacker running within a restricted Docker container sets up an IPSec socket, maps a targeted system binary into memory, and triggers packet coalescence to write root privileges directly into the page cache, executing commands as root on the host kernel.","enterprise_blast_radius":"Kubernetes multi-tenant cluster collapse: breach in a low-privilege pod directly grants root access over the underlying bare-metal or cloud worker node."},"references":[{"url":"https://git.kernel.org/stable/c/3599e6b3cc1ada96883d496a50a210d3afbb6987","type":"patch","title":"Linux Kernel Git Commit 3599e6b"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","type":"cisa","title":"CISA KEV Notice"}],"published_at":"2026-10-28T00:00:00.000Z","updated_at":"2026-10-29T08:00:00.000Z"}}