{"id":"CVE-2026-46331","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: fix pedit partial COW leading to page cache corruption\n\ntcf_pedit_act() computes the COW range for skb_ensure_writable()\nonce before the key loop using tcfp_…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: fix pedit partial COW leading to page cache corruption\n\ntcf_pedit_act() computes the COW range for skb_ensure_writable()\nonce before the key loop using tcfp_…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-190","CWE-787"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 4.19.244, < 4.20","linux_kernel >= 5.4.195, < 5.5","linux_kernel >= 5.10.117, < 5.11","linux_kernel >= 5.15.41, < 5.16","linux_kernel >= 5.17.9, < 5.18","linux_kernel >= 5.18.1, < 6.12.94","linux_kernel >= 6.13, < 6.18.36","linux_kernel >= 6.19, < 7.0.13","linux_kernel = 5.18","linux_kernel = 7.1"],"patched":["linux_kernel 7.0.13"],"published":"2026-06-16","updated":"2026-10-15","sourceUpdated":"2026-10-15T02:19:54.270","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-46331","references":[{"url":"https://git.kernel.org/stable/c/2bec122b9fb91507a758ab5e3e5c4fbe7cb3f61b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3dee9d0c198faeb95d052c1b94c2958751a28512","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/544d857b42a1734b923040e13aa61a6fd4746cf2","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/899ee91156e57784090c5565e4f31bd7dbffbc5a","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a071e057518decc5e3bec89855758f5f8786f2c5","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b198ed4e52580a7238c7c7082f03906f8b310313","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b685d6ef6f07a3b5ce814565a25f39f2157538a5","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d5d01d35a5a7d36f7cb679b67d9cbdd5205672dc","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://access.redhat.com/errata/RHSA-2026:27288","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:27353","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:27354","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:27355","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:27704","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:27705","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:27706","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:27707","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:27708","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:27709","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:27713","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:27731","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:27789","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:28887","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:28962","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:29080","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:29794","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:29799","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:29833","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:29856","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:29863","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:33219","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:33220","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:33221","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:33222","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:33223","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:33224","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:33225","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:33666","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:34048","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:34098","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:40021","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-46331","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479492","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://github.com/sgkdev/packet_edit_meme/tree/main","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46331.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/vulnerabilities/RHSB-2026-008"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-46331"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46331"},{"url":"https://lore.kernel.org/netdev/20260516162825.1480113-1-rollkingzzc@gmail.com/"}],"tags":["nvd","exploit-available","cve.org","csaf","vex","red-hat"],"epss":0.00639,"epssPercentile":0.50395,"exploits":{"github":14,"githubRepos":["https://github.com/sgkdev/packet_edit_meme","https://github.com/0xBlackash/CVE-2026-46331","https://github.com/rjt-gupta/page-cache-corruption-lpes"],"checkedAt":"2026-10-27T19:00:56.882Z"},"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-06-29T00:00:00+00:00"},"scores":{"nvd":7.8,"vendor":6.7,"cna":7.8},"ingestedAt":"2026-06-29T15:48:27.678Z","slug":"CVE-2026-46331","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: fix pedit partial COW leading to page cache corruption\n\ntcf_pedit_act() computes the COW range for skb_ensure_writable()\nonce before the key loop using tcfp_off_max_hint, but the hint does\nnot account for the runtime header offset added by typed keys. This\ncan leave part of the write region un-COW'd.\n\nFix by moving skb_ensure_writable() inside the per-key loop where\nthe actual write offset is known, and add overflow checking on the\noffset arithmetic. For negative offsets (e.g. Ethernet header edits\nat ingress), use skb_cow() to COW the headroom instead. Guard\noffset_valid() against INT_MIN, where negation is undefined.\n\n## Affected\n\n- `linux_kernel >= 4.19.244, < 4.20`\n- `linux_kernel >= 5.4.195, < 5.5`\n- `linux_kernel >= 5.10.117, < 5.11`\n- `linux_kernel >= 5.15.41, < 5.16`\n- `linux_kernel >= 5.17.9, < 5.18`\n- `linux_kernel >= 5.18.1, < 6.12.94`\n- `linux_kernel >= 6.13, < 6.18.36`\n- `linux_kernel >= 6.19, < 7.0.13`\n- `linux_kernel = 5.18`\n- `linux_kernel = 7.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 7.0.13`\n\n## Vendor advisories\n\n- **RHSA-2026:27709** · Red Hat · fixed in: NVIDIA for RHEL 10 · released 2026-06-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:27709)\n- **RHSA-2026:33666** · Red Hat · fixed in: NVIDIA for RHEL 10 · released 2026-06-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:33666)\n- **RHSA-2026:34048** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.12 · released 2026-07-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:34048)\n- **RHSA-2026:40021** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.13 · released 2026-07-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:40021)\n- **RHSA-2026:28887** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.14 · released 2026-07-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:28887)\n- **RHSA-2026:28962** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.15 · released 2026-07-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:28962)\n- **RHSA-2026:29080** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.16 · released 2026-07-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:29080)\n- **RHSA-2026:34098** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.17 · released 2026-07-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:34098)\n- **RHSA-2026:29856** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.18 · released 2026-07-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:29856)\n- **RHSA-2026:29863** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.19 · released 2026-07-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:29863)\n- **RHSA-2026:29799** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.20 · released 2026-06-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:29799)\n- **Red Hat VEX** · Important · affected: Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat OpenShift Container Platform 4 · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46331.json)","depth":"midnight","depthScore":55,"depthScoreParts":{"impact":42.9,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":5250,"id":"CVE-2026-46331","ts":1788887256795,"field":"exploit_available","old":"false","new":"true"},{"seq":4133,"id":"CVE-2026-46331","ts":1788886373230,"field":"exploit_available","old":"true","new":"false"},{"seq":2906,"id":"CVE-2026-46331","ts":1788883039132,"field":"exploit_available","old":"false","new":"true"},{"seq":1935,"id":"CVE-2026-46331","ts":1788882442152,"field":"exploit_available","old":"true","new":"false"},{"seq":1024,"id":"CVE-2026-46331","ts":1788881876869,"field":"exploit_available","old":"false","new":"true"}]}