CISA lists exploited flaws in the Linux kernel and VMware ESX
The kernel flaw chains with two PHP flaws to implant web shells and run commands as root, and the ESX flaw lets an administrator work without leaving log entries.
Affects
Linux kernel without the stable
What to do
Patch PHP and the kernel on internet-facing Linux servers first, then upgrade ESX hosts to Broadcom's fixed builds.
- KEV release
- CVEs
- CVE-2026-46300CVE-2026-41709
- CVSS
- 7.8 (v3.1, NVD, CVE-2026-46300)2.7 (v3.1, VMware, CVE-2026-41709)
- Exploitation
- Exploited, in the CISA catalogue
- Affected
- Linux kernel without the stable fix 'net: skbuff: preserve shared-frag marker during coalescing'
- VMware Cloud Foundation and vSphere Foundation ESX 9.1.x.x and 9.0.x.x
- VMware ESX 8.0
- VMware Cloud Foundation ESX 5.x
- VMware Telco Cloud Platform ESX 5.0.x, 5.1.x
- Fixed in
- Linux kernel stable commits for 'net: skbuff: preserve shared-frag marker during coalescing', as listed by NVD
- ESXi-9.1.0.0-25370933
- ESXi-9.0.2.0100-25595025
- ESXi80U3j-25429389
- VMware Cloud Foundation 5.2.4
- Telco Cloud Platform: KB449886
What each flaw needs
After TCP receive coalescing drops a shared-fragment marker, the kernel's ESP code decrypts in place over page-cache-backed data. CISA states it can be chained with two PHP flaws to implant PHP web shells and run commands as root.
The ESX flaw needs admin access and lets that administrator act without being logged.
What to do now
Linux servers running PHP on the internet go first: both PHP flaws allow unauthenticated remote code execution, and the kernel flaw turns that into root.
- Patch PHP on every internet-facing server, starting from CISA's PHP alert of 21 October 2026
- Install your distribution's kernel with the skbuff shared-frag fix, reboot, and confirm each server runs it
- Upgrade ESX hosts to Broadcom's fixed build for their branch; 8.0 U2 hosts move to the 8.0 U3 line
- Apply ESXi-9.1.0.0200-25557999 or ESXi80U3k-25595708, Broadcom's fixes for a VMXNET3 flaw that lets a VM administrator run code on the host
- Remove unused ESX and vCenter admin accounts; rotate passwords on the rest
Who is affected
Linux servers that run PHP web applications face the full chain. NVD links Red Hat errata, so check your distribution's advisory for a kernel carrying the skbuff shared-frag fix.
Broadcom lists ESX standalone and within Cloud Foundation, vSphere Foundation and Telco Cloud Platform; Workstation and Fusion are not listed for this flaw.
Detection notes
The kernel chain ends in PHP web shells running as root, so web roots and process trees on PHP servers are the first place to look. Because the ESX flaw hides certain administrator operations, check host state against vCenter events and change tickets.
- PHP files in web roots that no deployment created
- Web server processes spawning shells or running commands as root
- ESX configuration, VM or account changes with no matching log entry
Essential Eight mapping
Patch operating systems and patch applications: the Essential Eight Maturity Model sets 48 hours for operating systems of internet-facing servers where a working exploit exists, and the kernel chain is exploited. Restrict administrative privileges: the ESX flaw needs an admin account.
Sources
- PrimaryCISA, Known Exploited Vulnerabilities Catalog (release 2026.10.30)Retrieved 31 Oct 2026
- PrimaryBroadcom, VMSA-2026-0006.2: VMware ESX, vCenter, Workstation, and Fusion updates address multiple vulnerabilities (updated 19 August 2026)Retrieved 31 Oct 2026
- PrimaryNVD, CVE-2026-46300Retrieved 31 Oct 2026
- PrimaryNVD, CVE-2026-41709Retrieved 31 Oct 2026
- PrimaryASD, Essential Eight Maturity ModelRetrieved 29 Oct 2026
