Skip to content
CVE-2026-46300 Elastic Security · Elastic

Detect Linux Kernel Shared-Fragment Marker Loss Page-Cache Tampering and Root Webshell Chain (CVE-2026-46300) in Elastic Security

Detects exploitation of CVE-2026-46300, a missing initialization flaw (CWE-456, with CWE-787 and CWE-123 in NVD) in the Linux kernel networking stack: skb_try_coalesce() loses the SKBFL_SHARED_FRAG marker, so ESP input processing can decrypt shared, page-cache-backed fragments in place and modify file data the caller does not own. The CVE is on the CISA KEV catalog (added 2026-10-28, BOD 26-04) and CISA notes it chains with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root. The flaw is local (AV:L, PR:L), so no product log names it. Detection keys on what Linux hosts can show after the chain: web server and PHP worker processes (www-data, apache, nginx, php-fpm) spawning shells or running as root, PHP files under web roots changing without a deploy, and kernel or audit messages about XFRM/ESP errors from unprivileged local users. Confidence is medium to low because the primitive itself leaves no dedicated log line.

MITRE ATT&CK

Tactic
Privilege Escalation Execution

Elastic Detection Query

Elastic Security (Elastic)
eql 
// df00tech DF00-be69a82488 · https://df00tech.com/detections/CVE-2026-46300 · licence: https://df00tech.com/detections/licence
sequence by host.id with maxspan=10m
  [process where event.type == "start" and host.os.type == "linux" and
   process.parent.name in ("php-fpm", "php-fpm8", "php", "apache2", "httpd", "nginx") and
   process.name in ("sh", "bash", "dash") and user.name in ("www-data", "apache", "nginx")]
  [process where event.type == "start" and host.os.type == "linux" and
   process.parent.name in ("php-fpm", "php-fpm8", "php", "apache2", "httpd", "nginx", "sh", "bash") and
   user.id == "0" and process.name in ("id", "whoami", "sh", "bash", "curl", "wget")]
high severity low confidence

Elastic EQL sequence: a shell spawned by a web or PHP worker under a web account, followed within ten minutes by a root-owned command from the same lineage on the same host.

Data Sources

Elastic DefendLinux process events

Required Tables

logs-endpoint.events.process-*

False Positives & Tuning

  • PHP applications that legitimately shell out (image processing, backups) under a web account
  • Deployment hooks that call sudo from a web-owned process
  • Container entrypoints where the web server starts as root and drops privileges

Other platforms for CVE-2026-46300

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are further down this page.

  1. Test 1 Spawn a shell from a web-account process (Lab Only)

    Expected signal: Process start events for sh under a php parent with user www-data; audit execve records

  2. Test 2 Log a synthetic web-to-root escalation line (Lab Only)

    Expected signal: Syslog message with process sudo containing www-data and uid=0

  3. Test 3 Check kernel version against fixed releases

    Expected signal: Command line event for uname and ip xfrm; no persistent changes

Last updated: Research depth: standard
References (2)

Response Playbook

Triage

  1. Confirm the host runs an affected Linux kernel (uname -r against the fixed releases 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10) and whether IPsec ESP or XFRM is in use.
  2. Review the process tree for a shell under a web or PHP worker and any later root-owned child; note the user, parent and command line.
  3. List PHP files under the web roots with modification times outside the last deploy; compare hashes with the deployed release, since page-cache tampering can differ from the on-disk copy.
  4. Check whether the host also lacks fixes for CVE-2026-109618 and CVE-2026-109619, which CISA names as part of the chain.

Containment

  1. Isolate the host from the network and stop the web service; apply the kernel update and reboot, which also drops tampered page-cache contents.
  2. Rotate secrets readable by the web account and by root on the host, and rebuild from a known-good image if a root shell is confirmed.

Evidence Collection

  1. Capture memory and the page cache (for example with a live-forensics tool) before reboot, since the tampered data may exist only in memory.
  2. Preserve /var/log/auth.log, audit logs, web server access logs and the web root with hashes, as CISA's forensic triage requirement asks.

Escalation Criteria

  • !Escalate to incident response if any webshell is found or a root process descends from a web worker.
  • !Escalate further if the same web account or webshell appears on more than one host, or if credentials from the host were used elsewhere.

Investigation Guide

Forensic Artifacts

  • >Web server and PHP-FPM access logs showing requests to PHP files that are not part of the deployed release
  • >Audit records (execve) with a web account uid and a later uid 0 on the same host
  • >File hashes of PHP files under the web root compared with the release, including the in-memory page-cache copy
  • >Kernel messages mentioning xfrm or ESP around the time of the first suspicious process

Tuning Guidance

Build a list of web hosts that legitimately shell out and drop their known command lines. Exclude IPsec gateways from the xfrm keyword rules or narrow them to hosts without IPsec. Raise confidence to medium when a web-account shell and a root process occur on a host that is still on an affected kernel, and to high when a changed PHP file is also found.

Hunting Queries

Fourteen-day look-back for web service accounts reaching root on Linux hosts that were unpatched before this detection existed

Hunting — KQL
kql 
// df00tech DF00-be69a82488 · https://df00tech.com/detections/CVE-2026-46300 · licence: https://df00tech.com/detections/licence
Syslog
| where TimeGenerated > ago(14d)
| where SyslogMessage has_any ("www-data", "apache", "nginx", "php-fpm")
| where SyslogMessage has_any ("uid=0", "session opened for user root", "to root")
| summarize Events = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by Computer, ProcessName
| order by Events desc
Hunting — SPL
spl 
``` df00tech DF00-be69a82488 · https://df00tech.com/detections/CVE-2026-46300 · licence: https://df00tech.com/detections/licence ```
index=* (sourcetype=syslog OR sourcetype=linux_secure) earliest=-14d ("www-data" OR "apache" OR "nginx" OR "php-fpm") ("uid=0" OR "session opened for user root" OR "to root")
| stats count, earliest(_time) AS first_seen, latest(_time) AS last_seen by host
| sort - count

Atomic Red Team Tests

Test 1 Spawn a shell from a web-account process (Lab Only)
linux

Runs a shell under the www-data account with a PHP-FPM-like parent to exercise the web-worker-spawns-shell rules without exploiting the kernel.

Command

bash 
sudo -u www-data php -r 'system("id; uname -r");'

Cleanup

bash 
No cleanup required

Expected Telemetry

Process start events for sh under a php parent with user www-data; audit execve records

Expected Detection

Elastic EQL, CrowdStrike CQL and Chronicle YARA-L process rules should flag the shell started by the PHP process

Test 2 Log a synthetic web-to-root escalation line (Lab Only)
linux

Writes a syslog line shaped like a web account reaching root, to check log forwarding and the syslog-based searches.

Command

bash 
logger -p authpriv.notice -t sudo "www-data : TTY=pts/0 ; USER=root ; COMMAND=/bin/id (uid=0) CVE-2026-46300 test"

Cleanup

bash 
Remove the test line from the SIEM by filtering on the exact string

Expected Telemetry

Syslog message with process sudo containing www-data and uid=0

Expected Detection

Sentinel KQL, Splunk SPL, QRadar AQL and Sumo Logic searches should return the line

Test 3 Check kernel version against fixed releases
linux

Reads the running kernel and whether XFRM state is loaded, to find hosts that are exposed to CVE-2026-46300 and in scope for the rules.

Command

bash 
uname -r; ip xfrm state 2>/dev/null | head -5; lsmod | grep -E '^(esp4|esp6|xfrm_user)' || true

Cleanup

bash 
No cleanup required

Expected Telemetry

Command line event for uname and ip xfrm; no persistent changes

Expected Detection

EDR process telemetry records the commands; use the output to scope which hosts need the kernel update

Related Detections

Tactic Hubs

TA0004 Privilege Escalation TA0002 Execution ATT&CK Matrix

Related Techniques

T1068 Exploitation for Privilege Escalation T1505.003 Web Shell T1059.004 Unix Shell

Same Tactic: Privilege Escalation

Popular Detections