Linux Kernel Missing Initialization of a Variable Vulnerability

CVE-2026-46300 is a missing initialization of a variable vulnerability in the Linux Kernel. The flaw involves failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place, potentially allowing unintended modification of page-cache-backed data. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and execute commands as root, making it a critical threat. Multiple kernel stable branches are affected, with patches available across several Git commits. CISA has flagged this under BOD 26-04, which prioritizes security updates based on risk. Forensic triage requirements have also been outlined in CISA implementation guidance. The vulnerability affects open-source components and third-party libraries that may be used by a wide range of products.