CVE-2026-46300: Linux kernel vulnerability added to the CISA KEV catalog

CVE-2026-46300: Linux kernel vulnerability added to the CISA KEV catalog

In short

CVE-2026-46300 is a Linux kernel vulnerability, published on May 23, 2026, with a CVSS score of 7.8 (high severity) [1]. It is included in the CISA KEV catalog of known exploited vulnerabilities [2]. It affects Linux-based systems, including Red Hat and Siemens environments [1]. If your company operates servers, network equipment, or industrial devices running Linux, what needs to be done today is to identify which kernel versions you have in production and prioritize updating as soon as the patch is available for your distribution.

What it is and why it matters

The flaw lies in the Linux kernel's internal handling of network packets, specifically in the function that coalesces data fragments in memory during traffic processing [1]. According to the official description, when the kernel merges fragments marked as "shared" (shared-frag) coming from network buffers, that marker can be lost during the merge [1]. This breaks a check used by later routines, in particular ESP processing (the IPsec component that encrypts and decrypts traffic), to decide whether it can write over that data without copying it first [1]. The result is that, under certain circumstances, the system could end up modifying in place data backed by the system's own page cache, instead of treating it as external data that should not be touched directly [1].

This is a data integrity issue at the kernel level, not a simple application bug: it affects a layer that is common to virtually any service running on Linux and using IPsec/ESP-type network encryption. OCIRIA's intelligence radar classifies this vulnerability under the "Linux Kernel" category and assigns it an internal critical severity rating, above NVD's "high" rating, precisely because of its potential reach in production environments that rely on this type of network encryption.

Who is affected

The vendors/projects identified so far are Linux (the kernel project), Red Hat, and Siemens [1]. In practice, this can reach any organization operating servers, routers, load balancers, firewalls, or Linux-based industrial devices, especially those using IPsec/ESP to encrypt communications between sites, with vendors, or between internal components. It is not a problem limited to a single commercial product: since it involves the kernel, its impact depends on which distribution, version, and network configuration each system has.

How to know if you are vulnerable

Not all Linux kernel versions are necessarily affected in the same way, and the verified data structure does not include a closed list of specific versions, so it is advisable to check it case by case in your inventory:

• Check which kernel version each Linux server, firewall, or device is running, especially those handling traffic encrypted with IPsec/ESP.
• Check your distribution's security bulletin (Red Hat or another) to confirm whether your specific version is affected and whether a patch already exists [1].
• If you use Siemens equipment running embedded Linux, check the manufacturer's security advisories for that product line [1].
• Also check your exposed surface: which services with Linux components are visible from outside your internal network, since that determines how urgent action is in each case.

How to protect yourself

1. Inventory first: identify all production Linux systems and their kernel version before deciding anything.

2. Prioritize patching: apply kernel security updates as soon as they are available for your distribution, following the recommendation to audit versions and patch without delay.

3. Review your IPsec/ESP configuration: if your organization relies on VPNs or IPsec-based network encryption, confirm with your infrastructure team whether traffic passes through code paths affected by this flaw.

4. Segment and limit exposure: while the patch is being deployed, reduce exposure of the most critical systems to untrusted networks.

5. Monitor official advisories: follow the bulletins from your Linux distribution and, if applicable, from Siemens, since specific patches may be released in a staggered manner.

Frequently asked questions

Is this a new vulnerability? It was published on May 23, 2026 [1].

Is it being actively exploited? It appears in the CISA KEV catalog, which only includes vulnerabilities for which CISA has evidence of exploitation [2].

How severe is it? NVD rates it as high severity, with a CVSS of 7.8 [1]; OCIRIA's internal radar rates it as critical because of its reach into production infrastructure.

Does it only affect "pure" Linux servers? Not necessarily: Red Hat environments and Siemens equipment have also been identified as affected [1], so it is also worth reviewing industrial or embedded devices based on Linux.

What should I do if I don't know whether I'm affected? Start with an inventory of kernel versions and check your distribution's official bulletins; this is the most reliable way to confirm whether a specific system needs a patch.

Sources

• [1] https://nvd.nist.gov/vuln/detail/CVE-2026-46300
• [2] https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json