Attackers exploit Linux kernel flaw that lets local users overwrite memory

What happened

Attackers are exploiting a memory-corruption bug in the Linux kernel's networking code. When the kernel merges incoming TCP data into a single buffer, it can carry over memory pages that belong to someone else, such as the page cache. In that step it drops the flag that marks those pages as shared.

Later code relies on that flag. The ESP decryption path checks it to decide whether it must make a private copy before decrypting. Without the flag, it can decrypt directly on top of page-cache memory and overwrite data it should not touch.

The kernel fix restores the flag when pages are moved between buffers. The CVE was published on 23 May 2026. CISA added it to its Known Exploited Vulnerabilities catalog on 28 October 2026.

Who is affected

Linux kernel versions from 3.9 through 5.10.257 are affected. So are 5.11 before 5.15.208, 5.16 before 6.1.174, 6.2 before 6.6.141, 6.7 before 6.12.91, 6.13 before 6.18.33 and 6.19 before 7.0.10. Some pre-release kernel builds are also affected; the vendor advisory lists the affected and fixed versions. No fixed release has been named for the oldest affected branch.

Red Hat Enterprise Linux 6.0, 7.0, 8.0, 9.0 and 10.0 are affected, along with their EUS, AUS, TUS and SAP update-services editions. Red Hat OpenShift Container Platform 4.12 through 4.21 is affected before these releases: 4.12.91, 4.13.67, 4.14.68, 4.15.65, 4.16.63, 4.17.55, 4.18.43, 4.19.33, 4.20.24 and 4.21.17.

Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP firmware 3.1.5 through 3.1.6 is also affected.

How serious is it

The flaw has a CVSS score of 7.8. An attacker needs local access and a low-privileged account, but no user interaction. A successful attack can compromise the confidentiality, integrity and availability of the system.

CISA lists the bug as actively exploited. Federal agencies must apply the vendor's mitigations by 31 October 2026, or stop using the product if no mitigations are available.

What you should do

1. 1Update the Linux kernel to the fixed stable release for your branch, such as 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33 or 7.0.10.
2. 2Apply Red Hat's kernel updates for Red Hat Enterprise Linux.
3. 3Update OpenShift Container Platform to the fixed release for your version line, for example 4.21.17 or 4.20.24.
4. 4Follow Siemens' guidance for SIMATIC S7-1500 CPU 1518-4 PN/DP MFP firmware 3.1.5 and 3.1.6.
5. 5Apply vendor mitigations where an update is not yet available, and watch for further fixes.

Quick facts