net/sched: fix pedit partial COW leading to page cache corruption
In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.
CVE-2026-46331
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-46331
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "abe35bf3be51482593076d516a680d79e5fbc8e1",
"lessThan": "544d857b42a1734b923040e13aa61a6fd4746cf2",
"versionType": "git"
},
{
"status": "affected",
"version": "b773640d5bb9e2acfd91e2695717af04d47aa116",
"lessThan": "d5d01d35a5a7d36f7cb679b67d9cbdd5205672dc",
"versionType": "git"
},
{
"status": "affected",
"version": "8b796475fd7882663a870456466a4fb315cc1bd6",
"lessThan": "a071e057518decc5e3bec89855758f5f8786f2c5",
"versionType": "git"
},
{
"status": "affected",
"version": "8b796475fd7882663a870456466a4fb315cc1bd6",
"lessThan": "b685d6ef6f07a3b5ce814565a25f39f2157538a5",
"versionType": "git"
},
{
"status": "affected",
"version": "8b796475fd7882663a870456466a4fb315cc1bd6",
"lessThan": "2bec122b9fb91507a758ab5e3e5c4fbe7cb3f61b",
"versionType": "git"
},
{
"status": "affected",
"version": "8b796475fd7882663a870456466a4fb315cc1bd6",
"lessThan": "b198ed4e52580a7238c7c7082f03906f8b310313",
"versionType": "git"
},
{
"status": "affected",
"version": "8b796475fd7882663a870456466a4fb315cc1bd6",
"lessThan": "3dee9d0c198faeb95d052c1b94c2958751a28512",
"versionType": "git"
},
{
"status": "affected",
"version": "8b796475fd7882663a870456466a4fb315cc1bd6",
"lessThan": "899ee91156e57784090c5565e4f31bd7dbffbc5a",
"versionType": "git"
},
{
"status": "affected",
"version": "d0c38a914b0c4c21d553da801003d36979016726",
"versionType": "git"
},
{
"status": "affected",
"version": "2ec2dd7d51a9320151f275ddbb2b53260fb32ca1",
"versionType": "git"
},
{
"status": "affected",
"version": "c19cc520b3d69904e9518d401ad0df7f4702aca0",
"versionType": "git"
},
{
"status": "affected",
"version": "5.10.117",
"lessThan": "5.10.260",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.15.41",
"lessThan": "5.15.211",
"versionType": "semver"
},
{
"status": "affected",
"version": "4.19.244",
"lessThan": "4.20",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.4.195",
"lessThan": "5.5",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.17.9",
"lessThan": "5.18",
"versionType": "semver"
}
],
"programFiles": [
"include/net/tc_act/tc_pedit.h",
"net/sched/act_pedit.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.18",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.260",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.211",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver",
"lessThanOrEqual": "7.0.*"
},
{
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"include/net/tc_act/tc_pedit.h",
"net/sched/act_pedit.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-46331
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #28420 · Revision 1
- Added to Heist Feed
- Publisher date