pwned.coffeeOrder ticket · today's special · 28 Oct 2026

🔥 On the fly · exploited in the wildKEV due in 3dScalding · 540°ChighHalf-poured · some lines fixed

Linux Kernel Missing Initialization of a Variable Vulnerability

Linux kernel

Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place.

Do this now

Upgrade the Linux kernel to 7.0.10, 6.18.33, or 6.12.91, plus 3 more lines in Fix it.

Fix it

Linux

On 5.15.xUpgrade to Linux 5.15.208
On 6.1.xUpgrade to Linux 6.1.174
On 6.6.xUpgrade to Linux 6.6.141
On 6.12.xUpgrade to Linux 6.12.91
On 6.18.xUpgrade to Linux 6.18.33
On 7.0.xUpgrade to Linux 7.0.10
On 3.9.xFix not named in the CVE record: see vendor advisory

First seen: 28 Oct 2026
Last update: 28 Oct 2026, 20:19 UTC
Fixed in: 7.0.10
6.18.33
6.12.91
6.6.141
6.1.174
5.15.208
Identifiers: CVE-2026-46300
CVSS: 7.8
KEV deadline: 2026-10-31
Source: CISA KEV
On the menu as: Linux kernel

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Linux Kernel Missing Initialization of a Variable Vulnerability
Severity: high, exploited in the wild. Patch status: partial fix.
Affected: Linux kernel
Fixed in: 7.0.10, 6.18.33, 6.12.91, 6.6.141, 6.1.174, 5.15.208
Ids: CVE-2026-46300

Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place.

## Steps
1. This touches infrastructure (linux). Look in terraform, ansible, cloud-init, Dockerfiles and docs for the product and version we run. If it isn't in the repo, say so and list what a human should check on the box.
2. Fix by release line: Linux: 7.0.10; 6.18.33; 6.12.91; 6.6.141; 6.1.174; 5.15.208. Linux 3.9.x: the CVE record names no fix; check the vendor advisory before assuming there is none. Until one ships: restrict network access to it.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| Linux | fixed | 7.0.10 | — |
| Linux | fixed | 6.18.33 | — |
| Linux | fixed | 6.12.91 | — |
| Linux | fixed | 6.6.141 | — |
| Linux | fixed | 6.1.174 | — |
| Linux | fixed | 5.15.208 | — |
| Linux 3.9.x | not named in the CVE record | check the vendor advisory: https://git.kernel.org/stable/c/2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-46300") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://git.kernel.org/stable/c/2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c https://git.kernel.org/stable/c/3599e6b3cc1ada96883d496a50a210d3afbb6987 https://git.kernel.org/stable/c/3884358a9286b17f389a72b1426fc4547c23c111 https://git.kernel.org/stable/c/3bd9e113d50034db99d7ef69fd8e5242d15e414a https://git.kernel.org/stable/c/760e1addc27ba1a7beb4a0a7e8b3e9ec49e7a34e https://git.kernel.org/stable/c/78bf6b6bb19541d19fbda6242e7cfe2c682763c0 https://git.kernel.org/stable/c/9d3e5fd19fe1063bf607219e8562fbd567b8e8d5 https://git.kernel.org/stable/c/f84eca5817390257cef78013d0112481c503b4a3 https://nvd.nist.gov/vuln/detail/CVE-2026-46300
https://pwned.coffee/i/linux-kernel-missing-initialization-of-a-variable-vulner-cve-2026-46300

Timeline

28 Oct 2026, 20:19 UTC
Fix status: unknown → partial fix.
28 Oct 2026
First reported.

Receipt

Exploitation: Exploited: listed in CISA KEV
CISA KEV “CVE-2026-46300 added to CISA KEV on 2026-10-28, federal deadline 2026-10-31.” source
Fix by release line: Product Affected Fixed in Source
Linux before 7.0.10 7.0.10 NVD checked 28 Oct
Linux before 6.18.33 6.18.33 NVD checked 28 Oct
Linux before 6.12.91 6.12.91 NVD checked 28 Oct
Linux before 6.6.141 6.6.141 NVD checked 28 Oct
Linux before 6.1.174 6.1.174 NVD checked 28 Oct
Linux before 5.15.208 5.15.208 NVD checked 28 Oct
Linux = 3.9 fix not named in the CVE record: see vendor advisory CVE record (CNA) checked 28 Oct
The CVE record names no fix for one line; the vendor’s advisory may: git.kernel.org
Score: CVSS 7.8 (high). CVSS 3.1 7.8 (NVD) for CVE-2026-46300
Last checked: 28 Oct 2026, 20:19 UTC

Product	Affected	Fixed in	Source
Linux	before 7.0.10	7.0.10	NVD checked 28 Oct
Linux	before 6.18.33	6.18.33	NVD checked 28 Oct
Linux	before 6.12.91	6.12.91	NVD checked 28 Oct
Linux	before 6.6.141	6.6.141	NVD checked 28 Oct
Linux	before 6.1.174	6.1.174	NVD checked 28 Oct
Linux	before 5.15.208	5.15.208	NVD checked 28 Oct
Linux	= 3.9	fix not named in the CVE record: see vendor advisory	CVE record (CNA) checked 28 Oct

Sources: KEV ✓ CVE record ✓ Vendor ✓

Sources

Wrong fix version, or a source we missed? Send it back to chef@pwned.coffee with the source, and we'll correct it here.

Totalone hot coffee