← CVE Intelligence

CVE-2026-46331

net/sched: fix pedit partial COW leading to page cache corruption PUBLISHED

Description (CNA)

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.

Affected (CNA)

Vendor / productVersions
Linux / Linuxaffected abe35bf3be51482593076d516a680d79e5fbc8e1 before 544d857b42a1734b923040e13aa61a6fd4746cf2; affected b773640d5bb9e2acfd91e2695717af04d47aa116 before d5d01d35a5a7d36f7cb679b67d9cbdd5205672dc; affected 8b796475fd7882663a870456466a4fb315cc1bd6 before a071e057518decc5e3bec89855758f5f8786f2c5; affected 8b796475fd7882663a870456466a4fb315cc1bd6 before b685d6ef6f07a3b5ce814565a25f39f2157538a5; affected 8b796475fd7882663a870456466a4fb315cc1bd6 before 2bec122b9fb91507a758ab5e3e5c4fbe7cb3f61b; affected 8b796475fd7882663a870456466a4fb315cc1bd6 before b198ed4e52580a7238c7c7082f03906f8b310313; affected 8b796475fd7882663a870456466a4fb315cc1bd6 before 3dee9d0c198faeb95d052c1b94c2958751a28512; affected 8b796475fd7882663a870456466a4fb315cc1bd6 before 899ee91156e57784090c5565e4f31bd7dbffbc5a; affected d0c38a914b0c4c21d553da801003d36979016726; affected 2ec2dd7d51a9320151f275ddbb2b53260fb32ca1; affected c19cc520b3d69904e9518d401ad0df7f4702aca0; affected 5.10.117 before 5.10.260; affected 5.15.41 before 5.15.211; affected 4.19.244 before 4.20; affected 5.4.195 before 5.5; affected 5.17.9 before 5.18
Linux / Linuxaffected 5.18; unaffected 0 before 5.18; unaffected 5.10.260 through 5.10.*; unaffected 5.15.211 through 5.15.*; unaffected 6.1.177 through 6.1.*; unaffected 6.6.144 through 6.6.*; unaffected 6.12.94 through 6.12.*; unaffected 6.18.36 through 6.18.*; unaffected 7.0.13 through 7.0.*; unaffected 7.1 through *

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

redhat-SADP

A flaw was found in the Linux kernel's traffic control packet editing (pedit) subsystem. In tcf_pedit_act(), the copy-on-write (COW) range for skb_ensure_writable() is computed once before iterating over edit keys, but the calculation does not account for runtime header offsets added by typed keys. This can leave part of the target write region without a proper copy-on-write, leading to an out-of-bounds write that corrupts page cache memory. A local attacker with the ability to configure traffic control rules could exploit this to escalate privileges or crash the system.

siemens-SADP

No English description supplied.