Riskcovery

CVE-2026-46331

net/sched: fix pedit partial COW leading to page cache corruption

State
Published
Severity
7.8 High
Published
Jun 16, 2026
Updated
Oct 15, 2026
Reserved
May 13, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: fix pedit partial COW leading to page cache corruption

tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd.

Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux
3.16.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hredhat-SADP

Weaknesses

Affected Products

ProductVersions
LinuxLinux
  • abe35bf3be51482593076d516a680d79e5fbc8e1 to before 544d857b42a1734b923040e13aa61a6fd4746cf2Affected
  • b773640d5bb9e2acfd91e2695717af04d47aa116 to before d5d01d35a5a7d36f7cb679b67d9cbdd5205672dcAffected
  • 8b796475fd7882663a870456466a4fb315cc1bd6 to before a071e057518decc5e3bec89855758f5f8786f2c5Affected
  • 8b796475fd7882663a870456466a4fb315cc1bd6 to before b685d6ef6f07a3b5ce814565a25f39f2157538a5Affected
  • 8b796475fd7882663a870456466a4fb315cc1bd6 to before 2bec122b9fb91507a758ab5e3e5c4fbe7cb3f61bAffected
  • 8b796475fd7882663a870456466a4fb315cc1bd6 to before b198ed4e52580a7238c7c7082f03906f8b310313Affected
  • 8b796475fd7882663a870456466a4fb315cc1bd6 to before 3dee9d0c198faeb95d052c1b94c2958751a28512Affected
  • 8b796475fd7882663a870456466a4fb315cc1bd6 to before 899ee91156e57784090c5565e4f31bd7dbffbc5aAffected
  • d0c38a914b0c4c21d553da801003d36979016726Affected
  • 2ec2dd7d51a9320151f275ddbb2b53260fb32ca1Affected
  • c19cc520b3d69904e9518d401ad0df7f4702aca0Affected
  • 5.10.117 to before 5.10.260Affected
  • 5.15.41 to before 5.15.211Affected
  • 4.19.244 to before 4.20Affected
  • 5.4.195 to before 5.5Affected
  • 5.17.9 to before 5.18Affected
LinuxLinux
  • 5.18Affected
  • before 5.18Not affected
  • 5.10.260 through 5.10.*Not affected
  • 5.15.211 through 5.15.*Not affected
  • 6.1.177 through 6.1.*Not affected
  • 6.6.144 through 6.6.*Not affected
  • 6.12.94 through 6.12.*Not affected
  • 6.18.36 through 6.18.*Not affected
  • 7.0.13 through 7.0.*Not affected
  • 7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.