Skip to content

CVE-2026-46331 net/sched: fix pedit partial COW leading to page cache corruption

HighCVSS 7.8 EPSS 0.64%
Published
Updated
Exploit status
No public exploit known

Description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: fix pedit partial COW leading to page cache corruption

tcf_pedit_act() computes the COW range for skb_ensure_writable()
once before the key loop using tcfp_off_max_hint, but the hint does
not account for the runtime header offset added by typed keys. This
can leave part of the write region un-COW'd.

Fix by moving skb_ensure_writable() inside the per-key loop where
the actual write offset is known, and add overflow checking on the
offset arithmetic. For negative offsets (e.g. Ethernet header edits
at ingress), use skb_cow() to COW the headroom instead. Guard
offset_valid() against INT_MIN, where negation is undefined.

Affected products

ProductAffected versionsFixed in
Linux kernel >= abe35bf3be51482593076d516a680d79e5fbc8e1, < 544d857b42a1734b923040e13aa61a6fd4746cf2 544d857b42a1734b923040e13aa61a6fd4746cf2
Linux kernel >= b773640d5bb9e2acfd91e2695717af04d47aa116, < d5d01d35a5a7d36f7cb679b67d9cbdd5205672dc d5d01d35a5a7d36f7cb679b67d9cbdd5205672dc
Linux kernel >= 8b796475fd7882663a870456466a4fb315cc1bd6, < a071e057518decc5e3bec89855758f5f8786f2c5 a071e057518decc5e3bec89855758f5f8786f2c5
Linux kernel >= 8b796475fd7882663a870456466a4fb315cc1bd6, < b685d6ef6f07a3b5ce814565a25f39f2157538a5 b685d6ef6f07a3b5ce814565a25f39f2157538a5
Linux kernel >= 8b796475fd7882663a870456466a4fb315cc1bd6, < 2bec122b9fb91507a758ab5e3e5c4fbe7cb3f61b 2bec122b9fb91507a758ab5e3e5c4fbe7cb3f61b
Linux kernel >= 8b796475fd7882663a870456466a4fb315cc1bd6, < b198ed4e52580a7238c7c7082f03906f8b310313 b198ed4e52580a7238c7c7082f03906f8b310313
Linux kernel >= 8b796475fd7882663a870456466a4fb315cc1bd6, < 3dee9d0c198faeb95d052c1b94c2958751a28512 3dee9d0c198faeb95d052c1b94c2958751a28512
Linux kernel >= 8b796475fd7882663a870456466a4fb315cc1bd6, < 899ee91156e57784090c5565e4f31bd7dbffbc5a 899ee91156e57784090c5565e4f31bd7dbffbc5a
Linux kernel = d0c38a914b0c4c21d553da801003d36979016726 No fix listed
Linux kernel = 2ec2dd7d51a9320151f275ddbb2b53260fb32ca1 No fix listed
Linux kernel = c19cc520b3d69904e9518d401ad0df7f4702aca0 No fix listed
Linux kernel >= 5.10.117, < 5.10.260 5.10.260
Linux kernel >= 5.15.41, < 5.15.211 5.15.211
Linux kernel >= 4.19.244, < 4.20 4.20
Linux kernel >= 5.4.195, < 5.5 5.5
Linux kernel >= 5.17.9, < 5.18 5.18
Linux kernel = 5.18 No fix listed
Linux kernel < 5.10.260 5.10.260
Linux kernel < 5.15.211 5.15.211
Linux kernel < 6.1.177 6.1.177
Linux kernel < 6.6.144 6.6.144
Linux kernel < 6.12.94 6.12.94
Linux kernel < 6.18.36 6.18.36
Linux kernel < 7.0.13 7.0.13
Linux kernel < 7.1 7.1
Show 175 more
ProductAffected versionsFixed in
redhat enterprise linux nvidia < 0:6.12.0-212.11.el10nv 0:6.12.0-212.11.el10nv
redhat enterprise linux nvidia < 0:6.12.0-231.13.el10nv 0:6.12.0-231.13.el10nv
redhat enterprise linux < 0:6.12.0-211.26.1.el10_2 0:6.12.0-211.26.1.el10_2
redhat enterprise linux = 10.2 No fix listed
redhat enterprise linux eus < 0:6.12.0-55.82.1.el10_0 0:6.12.0-55.82.1.el10_0
redhat enterprise linux < 0:4.18.0-553.136.1.rt7.477.el8_10 0:4.18.0-553.136.1.rt7.477.el8_10
redhat enterprise linux < 0:4.18.0-553.136.1.el8_10 0:4.18.0-553.136.1.el8_10
redhat enterprise linux = 8 No fix listed
redhat rhel aus < 0:4.18.0-305.195.1.el8_4 0:4.18.0-305.195.1.el8_4
redhat rhel eus long life < 0:4.18.0-305.195.1.el8_4 0:4.18.0-305.195.1.el8_4
redhat rhel aus < 0:4.18.0-372.197.1.el8_6 0:4.18.0-372.197.1.el8_6
redhat rhel eus long life < 0:4.18.0-372.197.1.el8_6 0:4.18.0-372.197.1.el8_6
redhat rhel tus < 0:4.18.0-477.148.1.el8_8 0:4.18.0-477.148.1.el8_8
redhat rhel e4s < 0:4.18.0-477.148.1.el8_8 0:4.18.0-477.148.1.el8_8
redhat rhel e4s = 8.8 No fix listed
redhat enterprise linux < 0:5.14.0-687.17.1.el9_8 0:5.14.0-687.17.1.el9_8
redhat enterprise linux = 9 No fix listed
redhat rhel e4s < 0:5.14.0-284.177.1.el9_2 0:5.14.0-284.177.1.el9_2
redhat rhel e4s < 0:5.14.0-284.177.1.rt14.462.el9_2 0:5.14.0-284.177.1.rt14.462.el9_2
redhat rhel e4s = 9.2 No fix listed
redhat rhel e4s < 0:5.14.0-427.134.1.el9_4 0:5.14.0-427.134.1.el9_4
redhat rhel e4s = 9.4 No fix listed
redhat rhel eus < 0:5.14.0-570.123.1.el9_6 0:5.14.0-570.123.1.el9_6
redhat rhel eus = 9.6 No fix listed
redhat openshift < 412.86.202606251120-0 412.86.202606251120-0
redhat openshift < 413.92.202607141229-0 413.92.202607141229-0
redhat openshift < 414.92.202606231112-0 414.92.202606231112-0
redhat openshift < 415.92.202606200237-0 415.92.202606200237-0
redhat openshift < 416.94.202606230218-0 416.94.202606230218-0
redhat openshift < 417.94.202606250942-0 417.94.202606250942-0
redhat openshift < 418.94.202606221349-0 418.94.202606221349-0
redhat openshift < 4.19.9.6.202606241344-0 4.19.9.6.202606241344-0
redhat openshift < 4.20.9.6.202606241928-0 4.20.9.6.202606241928-0
redhat openshift < 4.21.9.6.202606241859-0 4.21.9.6.202606241859-0
redhat openshift < 4.22.9.8.202606230855-0 4.22.9.8.202606230855-0
redhat enterprise linux = 10 No fix listed
redhat enterprise linux = 6 No fix listed
redhat enterprise linux = 7 No fix listed
redhat openshift All versions No fix listed
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem All versions No fix listed
redhat/kernel(Red Hat:enterprise_linux_nvidia:10::el10) < 6.12.0-212.11.el10nv 6.12.0-212.11.el10nv
redhat/kernel(Red Hat:enterprise_linux_nvidia:10::el10) < 6.12.0-231.13.el10nv 6.12.0-231.13.el10nv
redhat/kernel(Red Hat:enterprise_linux:10.2) < 6.12.0-211.26.1.el10_2 6.12.0-211.26.1.el10_2
redhat/kpatch-patch(Red Hat:enterprise_linux:10.2) All versions No fix listed
redhat/kernel(Red Hat:enterprise_linux_eus:10.0) < 6.12.0-55.82.1.el10_0 6.12.0-55.82.1.el10_0
redhat/kernel-rt(Red Hat:enterprise_linux:8::nfv) < 4.18.0-553.136.1.rt7.477.el8_10 4.18.0-553.136.1.rt7.477.el8_10
redhat/kernel(Red Hat:enterprise_linux:8) < 4.18.0-553.136.1.el8_10 4.18.0-553.136.1.el8_10
redhat/kpatch-patch(Red Hat:enterprise_linux:8) All versions No fix listed
redhat/kernel(Red Hat:rhel_aus:8.4) < 4.18.0-305.195.1.el8_4 4.18.0-305.195.1.el8_4
redhat/kernel(Red Hat:rhel_eus_long_life:8.4) < 4.18.0-305.195.1.el8_4 4.18.0-305.195.1.el8_4
redhat/kernel(Red Hat:rhel_aus:8.6) < 4.18.0-372.197.1.el8_6 4.18.0-372.197.1.el8_6
redhat/kernel(Red Hat:rhel_eus_long_life:8.6) < 4.18.0-372.197.1.el8_6 4.18.0-372.197.1.el8_6
redhat/kernel(Red Hat:rhel_tus:8.8) < 4.18.0-477.148.1.el8_8 4.18.0-477.148.1.el8_8
redhat/kernel(Red Hat:rhel_e4s:8.8) < 4.18.0-477.148.1.el8_8 4.18.0-477.148.1.el8_8
redhat/kpatch-patch(Red Hat:rhel_e4s:8.8) All versions No fix listed
redhat/kernel(Red Hat:enterprise_linux:9) < 5.14.0-687.17.1.el9_8 5.14.0-687.17.1.el9_8
redhat/kpatch-patch(Red Hat:enterprise_linux:9) All versions No fix listed
redhat/kernel(Red Hat:rhel_e4s:9.2) < 5.14.0-284.177.1.el9_2 5.14.0-284.177.1.el9_2
redhat/kernel-rt(Red Hat:rhel_e4s:9.2::nfv) < 5.14.0-284.177.1.rt14.462.el9_2 5.14.0-284.177.1.rt14.462.el9_2
redhat/kpatch-patch(Red Hat:rhel_e4s:9.2) All versions No fix listed
redhat/kernel(Red Hat:rhel_e4s:9.4) < 5.14.0-427.134.1.el9_4 5.14.0-427.134.1.el9_4
redhat/kpatch-patch(Red Hat:rhel_e4s:9.4) All versions No fix listed
redhat/kernel(Red Hat:rhel_eus:9.6) < 5.14.0-570.123.1.el9_6 5.14.0-570.123.1.el9_6
redhat/kpatch-patch(Red Hat:rhel_eus:9.6) All versions No fix listed
redhat/openshift/ose-rhel-coreos(Red Hat:openshift:4.12::el8) < 8:412.86.202606251120-0 8:412.86.202606251120-0
redhat/openshift/ose-rhel-coreos(Red Hat:openshift:4.13::el9) < 9:413.92.202607141229-0 9:413.92.202607141229-0
redhat/openshift/ose-rhel-coreos(Red Hat:openshift:4.14::el9) < 9:414.92.202606231112-0 9:414.92.202606231112-0
redhat/openshift/ose-rhel-coreos(Red Hat:openshift:4.15::el9) < 9:415.92.202606200237-0 9:415.92.202606200237-0
redhat/openshift/ose-rhel-coreos(Red Hat:openshift:4.16::el9) < 9:416.94.202606230218-0 9:416.94.202606230218-0
redhat/openshift/ose-rhel-coreos(Red Hat:openshift:4.17::el9) < 9:417.94.202606250942-0 9:417.94.202606250942-0
redhat/openshift/ose-rhel-coreos(Red Hat:openshift:4.18::el9) < 9:418.94.202606221349-0 9:418.94.202606221349-0
redhat/openshift/ose-rhel-coreos(Red Hat:openshift:4.19::el9) < 9:4.19.9.6.202606241344-0 9:4.19.9.6.202606241344-0
redhat/openshift/ose-rhel-coreos(Red Hat:openshift:4.20::el9) < 9:4.20.9.6.202606241928-0 9:4.20.9.6.202606241928-0
redhat/openshift/ose-rhel-coreos(Red Hat:openshift:4.21::el9) < 9:4.21.9.6.202606241859-0 9:4.21.9.6.202606241859-0
redhat/openshift/ose-rhel-coreos(Red Hat:openshift:4.22::el9) < 9:4.22.9.8.202606230855-0 9:4.22.9.8.202606230855-0
debian/linux(Debian:12) < 6.1.176-1 6.1.176-1
debian/linux(Debian:12) = 6.1.106-1 No fix listed
debian/linux(Debian:12) = 6.1.106-2 No fix listed
debian/linux(Debian:12) = 6.1.106-3 No fix listed
debian/linux(Debian:12) = 6.1.112-1 No fix listed
debian/linux(Debian:12) = 6.1.115-1 No fix listed
debian/linux(Debian:12) = 6.1.119-1 No fix listed
debian/linux(Debian:12) = 6.1.123-1 No fix listed
debian/linux(Debian:12) = 6.1.124-1 No fix listed
debian/linux(Debian:12) = 6.1.128-1 No fix listed
debian/linux(Debian:12) = 6.1.129-1 No fix listed
debian/linux(Debian:12) = 6.1.133-1 No fix listed
debian/linux(Debian:12) = 6.1.135-1 No fix listed
debian/linux(Debian:12) = 6.1.137-1 No fix listed
debian/linux(Debian:12) = 6.1.139-1 No fix listed
debian/linux(Debian:12) = 6.1.140-1 No fix listed
debian/linux(Debian:12) = 6.1.147-1 No fix listed
debian/linux(Debian:12) = 6.1.148-1 No fix listed
debian/linux(Debian:12) = 6.1.153-1 No fix listed
debian/linux(Debian:12) = 6.1.158-1 No fix listed
debian/linux(Debian:12) = 6.1.159-1 No fix listed
debian/linux(Debian:12) = 6.1.162-1 No fix listed
debian/linux(Debian:12) = 6.1.164-1 No fix listed
debian/linux(Debian:12) = 6.1.170-1 No fix listed
debian/linux(Debian:12) = 6.1.170-2 No fix listed
debian/linux(Debian:12) = 6.1.170-3 No fix listed
debian/linux(Debian:12) = 6.1.172-1 No fix listed
debian/linux(Debian:12) = 6.1.174-1 No fix listed
debian/linux(Debian:12) = 6.1.27-1 No fix listed
debian/linux(Debian:12) = 6.1.37-1 No fix listed
debian/linux(Debian:12) = 6.1.38-1 No fix listed
debian/linux(Debian:12) = 6.1.38-2 No fix listed
debian/linux(Debian:12) = 6.1.38-2~bpo11+1 No fix listed
debian/linux(Debian:12) = 6.1.38-3 No fix listed
debian/linux(Debian:12) = 6.1.38-4 No fix listed
debian/linux(Debian:12) = 6.1.38-4~bpo11+1 No fix listed
debian/linux(Debian:12) = 6.1.52-1 No fix listed
debian/linux(Debian:12) = 6.1.55-1 No fix listed
debian/linux(Debian:12) = 6.1.55-1~bpo11+1 No fix listed
debian/linux(Debian:12) = 6.1.64-1 No fix listed
debian/linux(Debian:12) = 6.1.66-1 No fix listed
debian/linux(Debian:12) = 6.1.67-1 No fix listed
debian/linux(Debian:12) = 6.1.69-1 No fix listed
debian/linux(Debian:12) = 6.1.69-1~bpo11+1 No fix listed
debian/linux(Debian:12) = 6.1.76-1 No fix listed
debian/linux(Debian:12) = 6.1.76-1~bpo11+1 No fix listed
debian/linux(Debian:12) = 6.1.82-1 No fix listed
debian/linux(Debian:12) = 6.1.85-1 No fix listed
debian/linux(Debian:12) = 6.1.90-1 No fix listed
debian/linux(Debian:12) = 6.1.90-1~bpo11+1 No fix listed
debian/linux(Debian:12) = 6.1.94-1 No fix listed
debian/linux(Debian:12) = 6.1.94-1~bpo11+1 No fix listed
debian/linux(Debian:12) = 6.1.98-1 No fix listed
debian/linux(Debian:12) = 6.1.99-1 No fix listed
debian/linux(Debian:13) < 6.12.94-1 6.12.94-1
debian/linux(Debian:13) = 6.12.38-1 No fix listed
debian/linux(Debian:13) = 6.12.41-1 No fix listed
debian/linux(Debian:13) = 6.12.43-1 No fix listed
debian/linux(Debian:13) = 6.12.43-1~bpo12+1 No fix listed
debian/linux(Debian:13) = 6.12.48-1 No fix listed
debian/linux(Debian:13) = 6.12.57-1 No fix listed
debian/linux(Debian:13) = 6.12.57-1~bpo12+1 No fix listed
debian/linux(Debian:13) = 6.12.63-1 No fix listed
debian/linux(Debian:13) = 6.12.63-1~bpo12+1 No fix listed
debian/linux(Debian:13) = 6.12.69-1 No fix listed
debian/linux(Debian:13) = 6.12.69-1~bpo12+1 No fix listed
debian/linux(Debian:13) = 6.12.73-1 No fix listed
debian/linux(Debian:13) = 6.12.73-1~bpo12+1 No fix listed
debian/linux(Debian:13) = 6.12.74-1 No fix listed
debian/linux(Debian:13) = 6.12.74-2 No fix listed
debian/linux(Debian:13) = 6.12.74-2~bpo12+1 No fix listed
debian/linux(Debian:13) = 6.12.85-1 No fix listed
debian/linux(Debian:13) = 6.12.85-1~bpo12+1 No fix listed
debian/linux(Debian:13) = 6.12.86-1 No fix listed
debian/linux(Debian:13) = 6.12.86-1~bpo12+1 No fix listed
debian/linux(Debian:13) = 6.12.88-1 No fix listed
debian/linux(Debian:13) = 6.12.88-1~bpo12+1 No fix listed
debian/linux(Debian:13) = 6.12.90-1 No fix listed
debian/linux(Debian:13) = 6.12.90-1~bpo12+1 No fix listed
debian/linux(Debian:13) = 6.12.90-2 No fix listed
debian/linux(Debian:13) = 6.12.90-2~bpo12+1 No fix listed
debian/linux(Debian:13) = 6.12.94-1~bpo12+1 No fix listed
debian/linux(Debian:14) < 7.0.13-1 7.0.13-1
debian/linux(Debian:14) = 6.12.100-1 No fix listed
debian/linux(Debian:14) = 6.12.101-1 No fix listed
debian/linux(Debian:14) = 6.12.105-1 No fix listed
debian/linux(Debian:14) = 6.12.107-1 No fix listed
debian/linux(Debian:14) = 6.12.111-1 No fix listed
debian/linux(Debian:14) = 6.12.38-1 No fix listed
debian/linux(Debian:14) = 6.12.41-1 No fix listed
debian/linux(Debian:14) = 6.12.43-1 No fix listed
debian/linux(Debian:14) = 6.12.43-1~bpo12+1 No fix listed
debian/linux(Debian:14) = 6.12.48-1 No fix listed
debian/linux(Debian:14) = 6.12.57-1 No fix listed
debian/linux(Debian:14) = 6.12.57-1~bpo12+1 No fix listed
debian/linux(Debian:14) = 6.12.63-1 No fix listed
debian/linux(Debian:14) = 6.12.63-1~bpo12+1 No fix listed
debian/linux(Debian:14) = 6.12.69-1 No fix listed
debian/linux(Debian:14) = 6.12.69-1~bpo12+1 No fix listed
debian/linux(Debian:14) = 6.12.73-1 No fix listed

References