CVE-2026-46331net/sched: fix pedit partial COW leading to page cache corruption
Updated under an hour ago ()
Does this affect you?
It affects Linux and 11 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-787, CWE-190
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from abe35bf3be51482593076d516a680d79e5fbc8e1 before 544d857b42a1734b923040e13aa61a6fd4746cf2; from b773640d5bb9e2acfd91e2695717af04d47aa116 before d5d01d35a5a7d36f7cb679b67d9cbdd5205672dc; from 8b796475fd7882663a870456466a4fb315cc1bd6 before a071e057518decc5e3bec89855758f5f8786f2c5; from 8b796475fd7882663a870456466a4fb315cc1bd6 before b685d6ef6f07a3b5ce814565a25f39f2157538a5; 8b796475fd7882663a870456466a4fb315cc1bd6 builds before 2bec122b9fb91507a758ab5e3e5c4fbe7cb3f61b; from 8b796475fd7882663a870456466a4fb315cc1bd6 before b198ed4e52580a7238c7c7082f03906f8b310313; 8b796475fd7882663a870456466a4fb315cc1bd6 builds before 3dee9d0c198faeb95d052c1b94c2958751a28512; from 8b796475fd7882663a870456466a4fb315cc1bd6 before 899ee91156e57784090c5565e4f31bd7dbffbc5a; and 8 more ranges | CNA record |
Red Hat NVIDIA for RHEL 10 redhat:enterprise_linux_nvidia | from 0:6.12.0-212.11.el10nv not affected; from 0:6.12.0-231.13.el10nv not affected | CISA ADP |
Red Hat Red Hat Enterprise Linux 10 redhat:enterprise_linux | from 0:6.12.0-211.26.1.el10_2 not affected | CISA ADP |
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support redhat:enterprise_linux_eus | from 0:6.12.0-55.82.1.el10_0 not affected | CISA ADP |
from 0:4.18.0-305.195.1.el8_4 not affected | CISA ADP | |
Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On redhat:rhel_eus_long_life | from 0:4.18.0-305.195.1.el8_4 not affected | CISA ADP |
from 0:4.18.0-477.148.1.el8_8 not affected | CISA ADP | |
from 0:4.18.0-477.148.1.el8_8 not affected | CISA ADP | |
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support redhat:rhel_eus | from 0:5.14.0-570.123.1.el9_6 not affected | CISA ADP |
Red Hat Red Hat OpenShift Container Platform 4.12 redhat:openshift | from 412.86.202606251120-0 not affected | CISA ADP |
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name) | all versions | CISA ADP |
linux linux_kernel linux:linux_kernel | from 4.19.244 before 4.20; from 5.4.195 before 5.5; from 5.10.117 before 5.11; from 5.15.41 before 5.16; from 5.17.9 before 5.18; from 5.18.1 before 6.12.94; from 6.13 before 6.18.36; from 6.19 before 7.0.13; and 8 more ranges | NVD |
References
- https://git.kernel.org/stable/c/544d857b42a1734b923040e13aa61a6fd4746cf2patch
- https://git.kernel.org/stable/c/d5d01d35a5a7d36f7cb679b67d9cbdd5205672dcpatch
- https://git.kernel.org/stable/c/a071e057518decc5e3bec89855758f5f8786f2c5patch
- https://git.kernel.org/stable/c/b685d6ef6f07a3b5ce814565a25f39f2157538a5patch
- https://git.kernel.org/stable/c/2bec122b9fb91507a758ab5e3e5c4fbe7cb3f61bpatch
- https://git.kernel.org/stable/c/b198ed4e52580a7238c7c7082f03906f8b310313patch
- https://git.kernel.org/stable/c/3dee9d0c198faeb95d052c1b94c2958751a28512patch
- https://git.kernel.org/stable/c/899ee91156e57784090c5565e4f31bd7dbffbc5apatch
- https://access.redhat.com/errata/RHSA-2026:27288third-party-advisory
- https://access.redhat.com/errata/RHSA-2026:27353third-party-advisory
- https://access.redhat.com/errata/RHSA-2026:27354third-party-advisory
- https://access.redhat.com/errata/RHSA-2026:27355third-party-advisory
- https://access.redhat.com/errata/RHSA-2026:27704third-party-advisory
- https://access.redhat.com/errata/RHSA-2026:27705third-party-advisory
- https://access.redhat.com/errata/RHSA-2026:27706third-party-advisory
- https://access.redhat.com/errata/RHSA-2026:27707third-party-advisory
- https://access.redhat.com/errata/RHSA-2026:27708third-party-advisory
- https://access.redhat.com/errata/RHSA-2026:27709third-party-advisory
- https://access.redhat.com/errata/RHSA-2026:27713third-party-advisory
- https://access.redhat.com/errata/RHSA-2026:27731third-party-advisory
- https://access.redhat.com/errata/RHSA-2026:27789third-party-advisory
- https://access.redhat.com/errata/RHSA-2026:28887third-party-advisory
- https://access.redhat.com/errata/RHSA-2026:28962issue-tracking
- https://access.redhat.com/errata/RHSA-2026:29080third-party-advisory
- https://access.redhat.com/errata/RHSA-2026:29794third-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.