--- id: CVE-2026-46331 title: |- In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_… summary: |- In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_… severity: high cvss: 7.8 cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H' cwe: - CWE-190 - CWE-787 vendor: linux product: linux_kernel affected: - 'linux_kernel >= 4.19.244, < 4.20' - 'linux_kernel >= 5.4.195, < 5.5' - 'linux_kernel >= 5.10.117, < 5.11' - 'linux_kernel >= 5.15.41, < 5.16' - 'linux_kernel >= 5.17.9, < 5.18' - 'linux_kernel >= 5.18.1, < 6.12.94' - 'linux_kernel >= 6.13, < 6.18.36' - 'linux_kernel >= 6.19, < 7.0.13' - linux_kernel = 5.18 - linux_kernel = 7.1 patched: - linux_kernel 7.0.13 published: '2026-06-16' updated: '2026-10-15' sourceUpdated: '2026-10-15T02:19:54.270' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-46331' references: - url: 'https://git.kernel.org/stable/c/2bec122b9fb91507a758ab5e3e5c4fbe7cb3f61b' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/3dee9d0c198faeb95d052c1b94c2958751a28512' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/544d857b42a1734b923040e13aa61a6fd4746cf2' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/899ee91156e57784090c5565e4f31bd7dbffbc5a' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/a071e057518decc5e3bec89855758f5f8786f2c5' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/b198ed4e52580a7238c7c7082f03906f8b310313' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/b685d6ef6f07a3b5ce814565a25f39f2157538a5' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/d5d01d35a5a7d36f7cb679b67d9cbdd5205672dc' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://access.redhat.com/errata/RHSA-2026:27288' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:27353' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:27354' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:27355' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:27704' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:27705' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:27706' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:27707' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:27708' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:27709' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:27713' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:27731' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:27789' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:28887' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:28962' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:29080' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:29794' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:29799' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:29833' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:29856' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:29863' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:33219' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:33220' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:33221' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:33222' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:33223' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:33224' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:33225' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:33666' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:34048' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:34098' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:40021' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/security/cve/CVE-2026-46331' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2479492' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://cert-portal.siemens.com/productcert/html/ssa-784472.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: 'https://github.com/sgkdev/packet_edit_meme/tree/main' label: 134c704f-9b21-4f2e-91b3-4a467353bcc0 - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46331.json label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/security/vulnerabilities/RHSB-2026-008' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-46331' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-46331' - url: >- https://lore.kernel.org/netdev/20260516162825.1480113-1-rollkingzzc@gmail.com/ tags: - nvd - exploit-available - cve.org - csaf - vex - red-hat epss: 0.00639 epssPercentile: 0.50395 exploits: github: 14 githubRepos: - 'https://github.com/sgkdev/packet_edit_meme' - 'https://github.com/0xBlackash/CVE-2026-46331' - 'https://github.com/rjt-gupta/page-cache-corruption-lpes' checkedAt: '2026-10-27T19:00:56.882Z' exploitAvailable: true ssvc: exploitation: poc automatable: 'no' technicalImpact: total timestamp: '2026-06-29T00:00:00+00:00' scores: nvd: 7.8 vendor: 6.7 cna: 7.8 ingestedAt: '2026-06-29T15:48:27.678Z' --- ## Overview In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined. ## Affected - `linux_kernel >= 4.19.244, < 4.20` - `linux_kernel >= 5.4.195, < 5.5` - `linux_kernel >= 5.10.117, < 5.11` - `linux_kernel >= 5.15.41, < 5.16` - `linux_kernel >= 5.17.9, < 5.18` - `linux_kernel >= 5.18.1, < 6.12.94` - `linux_kernel >= 6.13, < 6.18.36` - `linux_kernel >= 6.19, < 7.0.13` - `linux_kernel = 5.18` - `linux_kernel = 7.1` ## Remediation Upgrade past the affected range: - `linux_kernel 7.0.13` ## Vendor advisories - **RHSA-2026:27709** · Red Hat · fixed in: NVIDIA for RHEL 10 · released 2026-06-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:27709) - **RHSA-2026:33666** · Red Hat · fixed in: NVIDIA for RHEL 10 · released 2026-06-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:33666) - **RHSA-2026:34048** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.12 · released 2026-07-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:34048) - **RHSA-2026:40021** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.13 · released 2026-07-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:40021) - **RHSA-2026:28887** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.14 · released 2026-07-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:28887) - **RHSA-2026:28962** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.15 · released 2026-07-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:28962) - **RHSA-2026:29080** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.16 · released 2026-07-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:29080) - **RHSA-2026:34098** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.17 · released 2026-07-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:34098) - **RHSA-2026:29856** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.18 · released 2026-07-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:29856) - **RHSA-2026:29863** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.19 · released 2026-07-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:29863) - **RHSA-2026:29799** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.20 · released 2026-06-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:29799) - **Red Hat VEX** · Important · affected: Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat OpenShift Container Platform 4 · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46331.json)