# Linux: patch the kernel used by the PHP2Shell escalation chain

Canonical: https://www.oktsec.com/radar/linux-kernel-cve-2026-46300
Publisher: Oktsec
Language: en
Published: 2026-10-28T23:52:08Z
Updated: 2026-10-28T23:52:08Z
Record reviewed: 2026-10-28T23:52:08Z
Latest evidence check: 2026-10-28T23:52:08Z
Disclosed: 2026-05-13

CISA added CVE-2026-46300 to KEV on October 28 and identifies a chain with the two original PHP2Shell CVEs that can reach root. Apply the distributor fix and verify the kernel actually running on each affected host.

## Evidence and response priority

- Category: Vulnerability
- Oktsec priority: Act now
- Rationale: CISA lists this kernel CVE in KEV. It requires local access on its own; CISA identifies a chain with PHP CVE-2026-109618 and CVE-2026-109619. Neither the chain nor KEV establishes compromise of an individual host.
- Evidence: Attacks confirmed
- Verification: Vendor confirmed
- Fix status: Fix available
- Exposure requirement: Application or configuration dependent
- Vendor: Linux
- Products: Linux kernel
- CVEs: CVE-2026-46300

## Technical overview

The kernel can lose a shared-fragment marker while combining socket buffers. Later ESP processing may overwrite data backed by the page cache. Red Hat describes local privilege escalation from a low-privilege account. This is not a standalone remote unauthenticated entry point.

CISA added CVE-2026-46300 to KEV on October 28, 2026. Its entry identifies a chain with PHP CVE-2026-109618 and CVE-2026-109619 that can implant webshells and run commands as root. This does not establish the same chain for CVE-2026-115560 or prove compromise of every Linux or PHP installation.

Use the distributor advisory to select the correction, including backports. Installing a new package does not demonstrate that the running kernel has changed.

The supplier timeline in the CVE record dates public disclosure to May 13; the Linux CNA record was published May 23. October 28 is the KEV addition date, not the disclosure date or the beginning of attacks. CISA federal remediation dates and triage requirements are not universal customer deadlines.

## Recommended response

Apply the kernel fix for your distribution, preserve evidence where compromise is suspected and activate the corrected kernel using the distributor procedure. Verify the running kernel after remediation.

Relevant to: Teams operating Linux hosts, including hosts serving affected PHP applications.

## CVE attribution

- CVE-2026-46300: Linux — Linux kernel. [Source](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/46xxx/CVE-2026-46300.json)

## CISA KEV evidence

Catalog: 2026.10.28
Checked: 2026-10-28T23:52:19.770Z

### [CVE-2026-46300](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-46300)

- Added: 2026-10-28
- Ransomware use: Not confirmed by CISA
- Federal due date: 2026-10-31
- Federal forensic triage: Yes

Action specified by CISA: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America.

## Supporting evidence

Snapshot checked: 2026-10-27T15:30:57.206Z. These dates do not change the incident’s editorial review date.

### FIRST EPSS forecast


No score returned for: CVE-2026-46300

EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-10-27T15:30:57.206Z.

## Response checklist

1. **Inventory affected host kernels** — Identify the distribution, kernel package and running kernel on each host. Include container hosts; updating a container image alone does not update its host kernel.
2. **Preserve evidence before disruptive changes** — Where compromise is suspected, preserve evidence with incident-response support. Investigate the initial access path as well as escalation; a kernel update does not remove an existing webshell.
3. **Apply the distributor correction** — Use the security update for the installed distribution and branch. Follow its reboot or supported live-patch procedure; upstream version numbers alone do not account for distribution backports.
4. **Verify the kernel in use** — Record the running kernel and the distributor advisory or supported live-patch verification result. An installed package or scheduled reboot is not proof that the fix is active.
5. **Review PHP separately** — Check CVE-2026-109618 and CVE-2026-109619 where PHP runs on the host. Keep their remediation separate from the kernel fix; CISA does not extend this chain claim to other PHP CVEs.

## Relevance to AI environments

Oktsec recommends including Linux hosts that run agents or hold their credentials in the inventory; the kernel flaw is not specific to AI software.

## Sources

- [CISA KEV: exact Linux CVE and PHP chain](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) — CISA; Government advisory; checked 2026-10-28T23:38:45Z
- [Linux CNA record and branch fixes](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/46xxx/CVE-2026-46300.json) — Linux; Vendor notice; checked 2026-10-28T23:38:45Z
- [Red Hat: local privilege escalation and distributor guidance](https://access.redhat.com/security/cve/CVE-2026-46300) — Red Hat; Vendor notice; checked 2026-10-28T23:38:45Z

## Editorial record

- 2026-10-28T23:52:08Z: Added advisory coverage with product-specific response steps and dated exploitation evidence.

## Related incidents

- [PHP2Shell: investigate from October 17](https://www.oktsec.com/radar/php2shell)

## Use this advisory in Radar

Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment.

[Open advisory](https://www.oktsec.com/radar/linux-kernel-cve-2026-46300) · [Build a response plan](https://www.oktsec.com/radar/linux-kernel-cve-2026-46300#review-workspace)

- [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=linux-kernel-cve-2026-46300&service=exposure_check)
- [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=linux-kernel-cve-2026-46300&service=patch_verification)

## Scope and corrections

Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure.

[Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.