# [CVE-2026-46300] Linux Kernel Page-Cache Uninitialized Variable Data Corruption & Root LPE
**Severity:** HIGH | **CVSS Base Score:** 8.8 (3.1)
**CVSS Vector:** `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`
**EPSS Exploit Probability:** 91.20% (Percentile: 98.50%)
**CISA KEV (In The Wild):** YES (Due: Sat Oct 31 2026 00:00:00 GMT+0000 (Coordinated Universal Time))
**Known Ransomware Campaigns:** None documented
**Exploit Status:** active_wild
**Published:** 2026-10-28 | **Updated:** 2026-10-29

## Executive Summary
Critical Linux Kernel memory management bug in socket buffer coalescing enabling local privilege escalation to root and remote container breakouts.

## Common Weakness Enumeration (CWE)
- **CWE-456**: Missing Initialization of a Variable
- **CWE-787**: Out-of-bounds Write

## Affected Vendors & Products
- **Vendor:** Linux | **Product:** Linux Kernel
  - **Affected Versions:** Kernel 6.1 through 6.11.x before stable commits
  - **Patched Version:** Linux 6.11.5 / 6.6.58 / 6.1.114

## Technical Root Cause Analysis (AI Defense Agent)
During socket buffer (skb) coalescing in the networking stack, uninitialized variables in the IPSec ESP handling path fail to preserve the shared-fragment marker. As a consequence, inbound packet decryption mutates memory buffers shared with the page cache, overwriting executable code or /etc/passwd in memory.

## Exploitation Mechanism & Attack Scenario
An attacker running within a restricted Docker container sets up an IPSec socket, maps a targeted system binary into memory, and triggers packet coalescence to write root privileges directly into the page cache, executing commands as root on the host kernel.

## Enterprise Blast Radius
Kubernetes multi-tenant cluster collapse: breach in a low-privilege pod directly grants root access over the underlying bare-metal or cloud worker node.

## Remediation & Mitigation Playbook
1. Update kernel packages and reboot affected nodes: `apt update && apt dist-upgrade -y` or `dnf update kernel`.
2. Restrict unprivileged user namespaces and unprivileged networking socket creation where possible.
3. Utilize runtime security agents (e.g. Falco, Cilium Tetragon) to alert on anomalous kernel page cache modifications.

## Detection Guidance & Telemetry
Inspect kernel logs (`dmesg`) for memory allocation warnings in `skb_coalesce` or anomalies in IPSec crypto transforms.

### Sigma Detection Rule
```yaml
title: Linux Kernel SKB Coalesce Exploit Detection
status: high
logsource:
  product: linux
  service: auditd
detection:
  selection:
    syscall: 'socket'
    proto: 'IPPROTO_ESP'
  condition: selection
```


## References
- [Linux Kernel Git Commit 3599e6b](https://git.kernel.org/stable/c/3599e6b3cc1ada96883d496a50a210d3afbb6987) (patch)
- [CISA KEV Notice](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) (cisa)