The U.S This article explores kernel vulnerability cybercriminals. . Cybersecurity and Infrastructure Security Agency has issued a warning about a Linux kernel vulnerability that cybercriminals are exploiting to gain unauthorized access to affected systems.
This flaw was added to CISA's Known Exploited Vulnerabilities catalog on October 28, 2026, and is considered a security issue with confirmed exploitation. The agency notes that attackers can chain the kernel flaw with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and execute commands as root.
The CVE record indicates that the skb_try_coalesce() function can bypass the SKBFL_SHARED_FRAG marker, which is crucial for preserving special handling of shared memory fragments. During the Encapsulating Security Payload (ESP) input processing, the kernel might bypass a protective copy step and decrypt data in place, potentially altering data that shouldn't be modified through this route. The CVSS score of 7.8 indicates high severity, and the assessment highlights a local attack that requires minimal privileges and no user interaction.
The CVE record indicates patched releases across various maintained branches, including Linux 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, and 7.0.10. The CISA alert demands immediate action, not routine updates.
