Description
Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.
Full record on cve.org →Affected packages
| Package | Vendor / Product | Version range | Status |
|---|---|---|---|
| kernel | Red Hat / Red Hat Enterprise Linux 7 | any version | unknown |
| kernel | Red Hat / Red Hat Enterprise Linux 6 | any version | unknown |
| kernel | Red Hat / Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | >= 0:4.18.0-305.192.1.el8_4, < * | unaffected |
| kernel | Red Hat / Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | >= 0:4.18.0-305.192.1.el8_4, < * | unaffected |
| kernel | Red Hat / Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions | >= 0:4.18.0-372.193.1.el8_6, < * | unaffected |
| kernel | Red Hat / Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | >= 0:4.18.0-372.193.1.el8_6, < * | unaffected |
| kernel | Red Hat / Red Hat Enterprise Linux 8.6 Telecommunications Update Service | >= 0:4.18.0-372.193.1.el8_6, < * | unaffected |
| kernel | Red Hat / Red Hat Enterprise Linux 8.8 Telecommunications Update Service | >= 0:4.18.0-477.143.1.el8_8, < * | unaffected |
| kernel | Red Hat / Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | >= 0:4.18.0-477.143.1.el8_8, < * | unaffected |
| kernel | Red Hat / Red Hat Enterprise Linux 8 | >= 0:4.18.0-553.125.1.el8_10, < * | unaffected |
| kernel | Red Hat / Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | >= 0:5.14.0-284.172.1.el9_2, < * | unaffected |
| kernel | Red Hat / Red Hat Enterprise Linux 9.4 Extended Update Support | >= 0:5.14.0-427.126.1.el9_4, < * | unaffected |
| kernel | Red Hat / Red Hat Enterprise Linux 9.6 Extended Update Support | >= 0:5.14.0-570.116.1.el9_6, < * | unaffected |
| kernel | Red Hat / Red Hat OpenShift Container Platform 4.21 | >= 0:5.14.0-570.116.1.el9_6, < * | unaffected |
| kernel | Red Hat / Red Hat Enterprise Linux 9 | >= 0:5.14.0-687.10.1.el9_8, < * | unaffected |
| kernel | Red Hat / Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | >= 0:5.14.0-70.180.1.el9_0, < * | unaffected |
| kernel | Red Hat / Red Hat Enterprise Linux 10 | >= 0:6.12.0-211.16.1.el10_2, < * | unaffected |
| kernel | Red Hat / NVIDIA for RHEL 10 | >= 0:6.12.0-211.8.el10nv, < * | unaffected |
| kernel | Red Hat / NVIDIA for RHEL 10 | >= 0:6.12.0-231.12.el10nv, < * | unaffected |
| kernel | Red Hat / Red Hat Enterprise Linux 10.0 Extended Update Support | >= 0:6.12.0-55.75.1.el10_0, < * | unaffected |
| kernel-rt | Red Hat / Red Hat Enterprise Linux 7 | any version | unknown |
| kernel-rt | Red Hat / Red Hat Enterprise Linux 8 | >= 0:4.18.0-553.125.1.rt7.466.el8_10, < * | unaffected |
| kernel-rt | Red Hat / Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | >= 0:5.14.0-284.172.1.rt14.457.el9_2, < * | unaffected |
| kernel-rt | Red Hat / Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | >= 0:5.14.0-70.180.1.rt21.252.el9_0, < * | unaffected |
| kpatch-patch | Red Hat / Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | any version | unknown |
| kpatch-patch | Red Hat / Red Hat Enterprise Linux 8 | any version | unknown |
| kpatch-patch | Red Hat / Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | any version | unknown |
| kpatch-patch | Red Hat / Red Hat Enterprise Linux 9.6 Extended Update Support | any version | unknown |
| kpatch-patch | Red Hat / Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | any version | unknown |
| Linux | Linux / Linux | >= 0, < 3.9 | unaffected |
| Linux | Linux / Linux | 3.9 | affected |
| Linux | Linux / Linux | >= 5.10.257, <= 5.10.* | unaffected |
| Linux | Linux / Linux | >= 5.15.208, <= 5.15.* | unaffected |
| Linux | Linux / Linux | >= 6.1.174, <= 6.1.* | unaffected |
| Linux | Linux / Linux | >= 6.12.91, <= 6.12.* | unaffected |
| Linux | Linux / Linux | >= 6.18.33, <= 6.18.* | unaffected |
| Linux | Linux / Linux | >= 6.6.141, <= 6.6.* | unaffected |
| Linux | Linux / Linux | >= 7.0.10, <= 7.0.* | unaffected |
| Linux | Linux / Linux | >= 7.1, <= * | unaffected |
| Linux | Linux / Linux | >= cef401de7be8c4e155c6746bfccf721a4fa5fab9, < 3599e6b3cc1ada96883d496a50a210d3afbb6987 | affected |
| Linux | Linux / Linux | >= cef401de7be8c4e155c6746bfccf721a4fa5fab9, < f84eca5817390257cef78013d0112481c503b4a3 | affected |
| Linux | Linux / Linux | >= cef401de7be8c4e155c6746bfccf721a4fa5fab9, < 3884358a9286b17f389a72b1426fc4547c23c111 | affected |
| Linux | Linux / Linux | >= cef401de7be8c4e155c6746bfccf721a4fa5fab9, < 3bd9e113d50034db99d7ef69fd8e5242d15e414a | affected |
| Linux | Linux / Linux | >= cef401de7be8c4e155c6746bfccf721a4fa5fab9, < 760e1addc27ba1a7beb4a0a7e8b3e9ec49e7a34e | affected |
| Linux | Linux / Linux | >= cef401de7be8c4e155c6746bfccf721a4fa5fab9, < 78bf6b6bb19541d19fbda6242e7cfe2c682763c0 | affected |
| Linux | Linux / Linux | >= cef401de7be8c4e155c6746bfccf721a4fa5fab9, < 9d3e5fd19fe1063bf607219e8562fbd567b8e8d5 | affected |
| Linux | Linux / Linux | >= cef401de7be8c4e155c6746bfccf721a4fa5fab9, < 2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c | affected |
| openshift | Red Hat / Red Hat OpenShift Container Platform 4.21 | >= 0:4.21.0-202605142021.p2.geab2218.assembly.stream.el10, < * | unaffected |
| rhcos | Red Hat / Red Hat OpenShift Container Platform 4.12 | >= 412.86.202605271418-0, < * | unaffected |
| rhcos | Red Hat / Red Hat OpenShift Container Platform 4.13 | >= 413.92.202605271328-0, < * | unaffected |
| rhcos | Red Hat / Red Hat OpenShift Container Platform 4.14 | >= 414.92.202606231112-0, < * | unaffected |
| rhcos | Red Hat / Red Hat OpenShift Container Platform 4.15 | >= 415.92.202606030318-0, < * | unaffected |
| rhcos | Red Hat / Red Hat OpenShift Container Platform 4.16 | >= 416.94.202605200242-0, < * | unaffected |
| rhcos | Red Hat / Red Hat OpenShift Container Platform 4.16 | >= 416.94.202606051757-0, < * | unaffected |
| rhcos | Red Hat / Red Hat OpenShift Container Platform 4.17 | >= 417.94.202606250942-0, < * | unaffected |
| rhcos | Red Hat / Red Hat OpenShift Container Platform 4.18 | >= 418.94.202605260517-0, < * | unaffected |
| rhcos | Red Hat / Red Hat OpenShift Container Platform 4.19 | >= 4.19.9.6.202606031700-0, < * | unaffected |
| rhcos | Red Hat / Red Hat OpenShift Container Platform 4.20 | >= 4.20.9.6.202605270908-0, < * | unaffected |
| rhcos | Red Hat / Red Hat OpenShift Container Platform 4.21 | >= 4.21.9.6.202606030721-0, < * | unaffected |
| SIMATIC S7-1500 CPU 1518-4 PN/DP MFP | Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP | >= V3.1.5, < * | affected |
| SIMATIC S7-1500 CPU 1518-4 PN/DP MFP | Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP | >= V3.1.5, < * | affected |
| SIMATIC S7-1500 CPU 1518-4 PN/DP MFP | Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP | >= V3.1.6, < V3.1.7 | affected |
| SIMATIC S7-1500 CPU 1518-4 PN/DP MFP | Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP | >= V3.1.6, < V3.1.7 | affected |
| SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP | Siemens / SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP | >= V3.1.5, < * | affected |
| SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP | Siemens / SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP | >= V3.1.5, < * | affected |
| SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP | Siemens / SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP | >= V3.1.6, < V3.1.7 | affected |
| SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP | Siemens / SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP | >= V3.1.6, < V3.1.7 | affected |
| SIPLUS S7-1500 CPU 1518-4 PN/DP MFP | Siemens / SIPLUS S7-1500 CPU 1518-4 PN/DP MFP | >= V3.1.5, < * | affected |
| SIPLUS S7-1500 CPU 1518-4 PN/DP MFP | Siemens / SIPLUS S7-1500 CPU 1518-4 PN/DP MFP | >= V3.1.6, < V3.1.7 | affected |