What happened
CISA added CVE-2026-46300 to the Known Exploited Vulnerabilities catalog on 2026-10-28 with confirmed in-the-wild exploitation. A missing-initialization flaw (CWE-456) in ESP input processing corrupts adjacent page-cache data during socket-buffer coalescing, potentially allowing data tampering or memory disclosure.
Why it matters
Not AI-specific, but confirmed in-the-wild in the OS kernel underpinning AI infrastructure — an exploited kernel flaw on ML nodes can yield memory corruption/data-tampering in the hosts running training and inference, and is a springboard for deeper compromise of GPU clusters.
Attack vector
Failure to preserve the shared-fragment marker during socket buffer coalescing causes ESP input processing to decrypt shared fragments in place, allowing a remote attacker to corrupt page-cache-backed data (authenticated IPsec traffic path).
Affected systems
Linux kernel (see stable fixes 3599e6b3cc1a, 2f2b16022a2e, 9d3e5fd19fe1)
Mitigation
Apply the upstream kernel stable fix and comply with CISA BOD 26-04 (federal due date 2026-10-31).