6 Linux Kernel Flaws in KEV Aug–Oct 2026—Reboot After Updating

While looking back through the CISA KEV list, I noticed that 6 Linux kernel vulnerabilities were added between late Aug. and 28 Oct. 2026. I have collected them in one post because the response is the same for all of them: update the kernel and reboot. Almost all are local vulnerabilities that turn a low-privilege account into root.

What happened

All 6 are bugs in kernel code handling networking, crypto and other subsystems, rather than web application vulnerabilities. The table below summarizes the CVE records and KEV entries.

The most interesting one is CVE-2026-46300, which Red Hat calls "Fragnesia". skb_try_coalesce() moves data fragments without preserving the shared-fragment flag, allowing ESP decryption to overwrite page cache pages backed by actual files. A local attacker can therefore write bytes into read-only files, such as privileged binaries, and escalate to root. The KEV entry also says this vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to plant a PHP webshell and run commands as root, matching the php2shell issue I wrote about earlier.

Severity

All 6 are in CISA KEV, which means they have been exploited in the wild. The SSVC data CISA attached to each CVE record lists exploitation as active. CVE-2025-39682 has a CVSS score of 9.8 because the CNA assigned the vector AV:N/PR:N, while the other 5 are AV:L, meaning the attacker must already have an account on the machine. That sounds less serious, but on a machine running multiple websites, a webshell planted on just one site already gives the attacker an account on the machine.

I want to draw particular attention to containers. Every container shares the host's kernel. Ubuntu's CVE-2026-46300 page says a local attacker may be able to escalate privileges or escape a container. CISA also notes in KEV that CVE-2026-53266 and CVE-2025-39682 may affect products that have reached end of support, and recommends discontinuing their use or migrating to a supported version.

Fixed versions in Debian and Ubuntu

Debian issued DSA-6602-1 on 2 Nov. 2026, covering more than 600 CVEs in a single advisory. The advisory lists 6.12.115-2 as the fixed version for Debian 13 (trixie). DSA-6602-1 itself does not list CVE-2026-46300, so I checked the individual entries in the Debian security tracker instead. I was able to read the full entries for 46300, 53266, 39964 and 39682, which list different minimum fixed versions (for example, 39682 was fixed in trixie 6.12.48-1 and bookworm 6.1.153-1, while 46300 and 53266 were fixed in trixie 6.12.107-1 and bookworm 6.1.176-1). However, all of them show the same latest versions in the security suite: trixie 6.12.115-2 and bookworm 6.1.190-1. I therefore recommend using these two versions as the targets to cover everything in one update. I have not yet verified 53362 and 2022-0995 individually in the tracker.

For Ubuntu, I only opened the CVE-2026-46300 page. The fixed versions of the main linux package are 7.0.0-22.22 for 26.04, 6.17.0-35.35 for 25.10, 6.8.0-124.124 for 24.04 and 5.15.0-181.191 for 22.04. For the others, open each vulnerability's ubuntu.com/security/CVE-... page and also check the version for the kernel flavor you use, such as linux-aws, because each flavor has its own version numbers.

How to fix it

The sequence is to install the new kernel, reboot, then check that the machine actually booted into the new version.

1. Prioritize machines by risk Start with machines that have multiple users, host multiple websites or run other people's containers
2. Update the kernel Through the distro's apt or dnf
3. Reboot Give advance notice of downtime as usual
4. Compare versions Use uname -v to compare against the installed version before closing the task

# Debian / Ubuntu
sudo apt update
sudo apt full-upgrade
sudo reboot

# RHEL / Rocky / AlmaLinux
sudo dnf upgrade --refresh 'kernel*'
sudo reboot

After the machine boots back up, compare the running version against the installed version, because installing a new package without rebooting does not change the running kernel.

uname -r        # kernel ที่รันอยู่ตอนนี้
uname -v        # Debian จะแสดงเลขแพ็กเกจ เช่น Debian 6.12.115-2
dpkg -l 'linux-image-*' | grep '^ii'    # ที่ติดตั้งไว้ทั้งหมด

# Ubuntu: ไฟล์นี้มีเมื่อต้องรีบูต
ls -l /var/run/reboot-required 2>/dev/null

# ตัวช่วยเช็ก kernel ที่รันกับที่ควรเป็น
sudo needrestart -k -b      # เทียบ NEEDRESTART-KCUR กับ NEEDRESTART-KEXP
sudo needs-restarting -r    # RHEL ตระกูลเดียวกัน (ต้องมีแพ็กเกจ dnf-utils)

If you cannot reboot immediately and need to postpone it, Ubuntu offers Livepatch. However, I have not checked the list of CVEs covered by livepatch, so I cannot confirm that it fixes all 6. Check the status with canonical-livepatch status --verbose and compare the CVEs against Canonical's own list. Do not guess.

Check whether you have been compromised

The sources I read contain no official IOCs for these 6 vulnerabilities. What I can check is general behavior after malicious code has been planted on a website.

# บัญชี UID 0 ที่ไม่ควรมี
awk -F: '$3==0 {print $1}' /etc/passwd

# ไฟล์ setuid ที่ถูกแก้ภายใน 30 วัน
sudo find / -xdev -perm -4000 -type f -mtime -30 -ls 2>/dev/null

# เว็บเก่าที่มีไฟล์ PHP แปลกๆ ใน uploads
find /home/webuser/public_html -name '*.php' -path '*uploads*' -mtime -30

If you find anything unusual, do not just delete the files, because an attacker who has already had root access may have planted something elsewhere. The safer approach is to build a new machine from a clean backup. I have written about checking Debian machines in debian-server-security-scan.

Personally, if a machine lets multiple people run code or hosts other people's containers, I would update and reboot it on the day I see the advisory. A single-user machine that does not expose services to anyone can wait until the next maintenance window, but I would not leave it longer than one week, because these 6 vulnerabilities have already been exploited in the wild.

P.S. The KEV entry for the latest vulnerability (CVE-2026-46300) sets a remediation deadline of 31 Oct. 2026 under the requirements for U.S. federal agencies. That is a signal that this cannot wait long.

Sources: CISA Known Exploited Vulnerabilities Catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog), CVE records for all 6 vulnerabilities on cve.org (https://www.cve.org/CVERecord?id=CVE-2026-46300), Debian DSA-6602-1 (https://lists.debian.org/debian-security-announce/2026/msg00521.html), Debian Security Tracker (https://security-tracker.debian.org/tracker/CVE-2026-46300), Ubuntu CVE tracker (https://ubuntu.com/security/CVE-2026-46300), Ubuntu blog Dirty Frag (https://ubuntu.com/blog/dirty-frag-linux-vulnerability-fixes-available). Information current as of 5 Nov. 2026. If other distros or kernel flavors release fixed versions later, I will come back and add them.