AI analysis
Claude Opus · 6 Nov 2026, 10:20 CET
Linux kernel networking flaw lets local users corrupt page-cache memory, now exploited
A Linux kernel flaw in network buffer coalescing can let a low-privileged local user overwrite page-cache-backed memory during IPsec decryption. CISA lists it as actively exploited. Apply vendor kernel updates now, prioritising multi-user systems, container hosts and Red Hat platforms.
In plain terms
The Linux kernel is the core of every Linux system, including servers, cloud workloads, container platforms such as Red Hat OpenShift, and some industrial devices. This flaw sits in the code that combines incoming network data into larger chunks. When it combines them, it can forget a safety label that says some of the memory is shared with other parts of the system, such as the page cache. The page cache is the kernel's in-memory copy of files that have been read from disk.
Because the label is lost, a later step that decrypts IPsec traffic (IPsec is a standard for encrypted network tunnels) may write its output directly over that shared memory. A user who already has a basic account on the machine could abuse this to corrupt memory they should not be able to change, which usually leads to full control of the system. Anyone running affected Linux kernels, Red Hat Enterprise Linux, OpenShift or the listed Siemens SIMATIC firmware should treat this as urgent, because CISA has confirmed it is being exploited.