{"id":"CVE-2026-46331","summary":"net/sched: fix pedit partial COW leading to page cache corruption","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: fix pedit partial COW leading to page cache corruption\n\ntcf_pedit_act() computes the COW range for skb_ensure_writable()\nonce before the key loop using tcfp_off_max_hint, but the hint does\nnot account for the runtime header offset added by typed keys. This\ncan leave part of the write region un-COW'd.\n\nFix by moving skb_ensure_writable() inside the per-key loop where\nthe actual write offset is known, and add overflow checking on the\noffset arithmetic. For negative offsets (e.g. Ethernet header edits\nat ingress), use skb_cow() to COW the headroom instead. Guard\noffset_valid() against INT_MIN, where negation is undefined.","modified":"2026-11-13T04:06:06.484437437Z","published":"2026-06-16T06:26:21.066Z","related":["ALSA-2026:27288","ALSA-2026:27353","ALSA-2026:27354","ALSA-2026:27789","SUSE-SU-2026:2195-1","SUSE-SU-2026:2238-1","SUSE-SU-2026:22521-1","SUSE-SU-2026:22522-1","SUSE-SU-2026:22665-1","SUSE-SU-2026:22666-1","SUSE-SU-2026:22742-1","SUSE-SU-2026:22769-1","SUSE-SU-2026:22812-1","SUSE-SU-2026:22835-1","SUSE-SU-2026:2799-1","SUSE-SU-2026:2800-1","SUSE-SU-2026:2839-1","SUSE-SU-2026:2840-1","SUSE-SU-2026:2841-1","SUSE-SU-2026:2914-1","SUSE-SU-2026:3044-1","SUSE-SU-2026:3089-1","SUSE-SU-2026:3156-1","SUSE-SU-2026:3702-1","SUSE-SU-2026:3703-1","SUSE-SU-2026:3706-1","SUSE-SU-2026:3707-1","SUSE-SU-2026:3708-1","SUSE-SU-2026:3709-1","SUSE-SU-2026:3710-1","SUSE-SU-2026:3715-1","SUSE-SU-2026:3717-1","SUSE-SU-2026:3721-1","SUSE-SU-2026:3722-1","SUSE-SU-2026:3723-1","SUSE-SU-2026:3724-1","SUSE-SU-2026:3728-1","SUSE-SU-2026:3729-1","SUSE-SU-2026:3734-1","SUSE-SU-2026:3739-1","SUSE-SU-2026:3740-1","SUSE-SU-2026:3743-1","SUSE-SU-2026:3744-1","SUSE-SU-2026:3747-1","SUSE-SU-2026:3749-1","SUSE-SU-2026:3750-1","SUSE-SU-2026:3756-1","SUSE-SU-2026:3757-1","SUSE-SU-2026:3759-1","SUSE-SU-2026:3766-1","SUSE-SU-2026:3808-1","SUSE-SU-2026:3826-1","openSUSE-SU-2026:21388-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46331.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"},{"type":"WEB","url":"https://git.kernel.org/stable/c/2bec122b9fb91507a758ab5e3e5c4fbe7cb3f61b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/3dee9d0c198faeb95d052c1b94c2958751a28512"},{"type":"WEB","url":"https://git.kernel.org/stable/c/544d857b42a1734b923040e13aa61a6fd4746cf2"},{"type":"WEB","url":"https://git.kernel.org/stable/c/899ee91156e57784090c5565e4f31bd7dbffbc5a"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a071e057518decc5e3bec89855758f5f8786f2c5"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b198ed4e52580a7238c7c7082f03906f8b310313"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b685d6ef6f07a3b5ce814565a25f39f2157538a5"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d5d01d35a5a7d36f7cb679b67d9cbdd5205672dc"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46331.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:27288"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:27353"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:27354"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:27355"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:27704"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:27705"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:27706"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:27707"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:27708"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:27709"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:27713"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:27731"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:27789"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:28887"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:28962"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:29080"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:29794"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:29799"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:29833"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:29856"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:29863"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:33219"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:33220"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:33221"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:33222"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:33223"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:33224"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:33225"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:33666"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34048"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34098"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:40021"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-46331"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46331.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46331"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479492"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"},{"type":"EVIDENCE","url":"https://github.com/sgkdev/packet_edit_meme/tree/main"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"abe35bf3be51482593076d516a680d79e5fbc8e1"},{"fixed":"544d857b42a1734b923040e13aa61a6fd4746cf2"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"b773640d5bb9e2acfd91e2695717af04d47aa116"},{"fixed":"d5d01d35a5a7d36f7cb679b67d9cbdd5205672dc"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"8b796475fd7882663a870456466a4fb315cc1bd6"},{"fixed":"a071e057518decc5e3bec89855758f5f8786f2c5"},{"fixed":"b685d6ef6f07a3b5ce814565a25f39f2157538a5"},{"fixed":"2bec122b9fb91507a758ab5e3e5c4fbe7cb3f61b"},{"fixed":"b198ed4e52580a7238c7c7082f03906f8b310313"},{"fixed":"3dee9d0c198faeb95d052c1b94c2958751a28512"},{"fixed":"899ee91156e57784090c5565e4f31bd7dbffbc5a"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"d0c38a914b0c4c21d553da801003d36979016726"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"2ec2dd7d51a9320151f275ddbb2b53260fb32ca1"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"c19cc520b3d69904e9518d401ad0df7f4702aca0"}]}],"versions":["v5.10.259","v5.10.258","v5.10.257","v5.10.256","v5.10.255","v5.10.254","v5.10.253","v5.10.252","v5.10.251","v5.10.250","v5.10.249","v5.10.248","v5.10.247","v5.10.246","v5.10.245","v5.10.244","v5.10.243","v5.10.242","v5.10.241","v5.10.240","v5.10.239","v5.10.238","v5.10.237","v5.10.236","v5.10.235","v5.10.234","v5.10.233","v5.10.232","v5.10.231","v5.10.230","v5.10.229","v5.10.228","v5.10.227","v5.10.226","v5.10.225","v5.10.224","v5.10.223","v5.10.222","v5.10.221","v5.10.220","v5.10.219","v5.10.218","v5.10.217","v5.10.216","v5.10.215","v5.10.214","v5.10.213","v5.10.212","v5.10.211","v5.10.210","v5.10.209","v5.10.208","v5.10.207","v5.10.206","v5.10.205","v5.10.204","v5.10.203","v5.10.202","v5.10.201","v5.10.200","v5.10.199","v5.10.198","v5.10.197","v5.10.196","v5.10.195","v5.10.194","v5.10.193","v5.10.192","v5.10.191","v5.10.190","v5.10.189","v5.10.188","v5.10.187","v5.10.186","v5.10.185","v5.10.184","v5.10.183","v5.10.182","v5.10.181","v5.10.180","v5.10.179","v5.10.178","v5.10.177","v5.10.176","v5.10.175","v5.10.174","v5.10.173","v5.10.172","v5.10.171","v5.10.170","v5.10.169","v5.10.168","v5.10.167","v5.10.166","v5.10.165","v5.10.164","v5.10.163","v5.10.162","v5.10.161","v5.10.160","v5.10.159","v5.10.158","v5.10.157","v5.10.156","v5.10.155","v5.10.154","v5.10.153","v5.10.152","v5.10.151","v5.10.150","v5.10.149","v5.10.148","v5.10.147","v5.10.146","v5.10.145","v5.10.144","v5.10.143","v5.10.142","v5.10.141","v5.10.140","v5.10.139","v5.10.138","v5.10.137","v5.10.136","v5.10.135","v5.10.134","v5.10.133","v5.10.132","v5.10.131","v5.10.130","v5.10.129","v5.10.128","v5.10.127","v5.10.126","v5.10.125","v5.10.124","v5.10.123","v5.10.122","v5.10.121","v5.10.120","v5.10.119","v5.10.118","v5.10.117","v5.15.210","v5.15.209","v5.15.208","v5.15.207","v5.15.206","v5.15.205","v5.15.204","v5.15.203","v5.15.202","v5.15.201","v5.15.200","v5.15.199","v5.15.198","v5.15.197","v5.15.196","v5.15.195","v5.15.194","v5.15.193","v5.15.192","v5.15.191","v5.15.190","v5.15.189","v5.15.188","v5.15.187","v5.15.186","v5.15.185","v5.15.184","v5.15.183","v5.15.182","v5.15.181","v5.15.180","v5.15.179","v5.15.178","v5.15.177","v5.15.176","v5.15.175","v5.15.174","v5.15.173","v5.15.172","v5.15.171","v5.15.170","v5.15.169","v5.15.168","v5.15.167","v5.15.166","v5.15.165","v5.15.164","v5.15.163","v5.15.162","v5.15.161","v5.15.160","v5.15.159","v5.15.158","v5.15.157","v5.15.156","v5.15.155","v5.15.154","v5.15.153","v5.15.152","v5.15.151","v5.15.150","v5.15.149","v5.15.148","v5.15.147","v5.15.146","v5.15.145","v5.15.144","v5.15.143","v5.15.142","v5.15.141","v5.15.140","v5.15.139","v5.15.138","v5.15.137","v5.15.136","v5.15.135","v5.15.134","v5.15.133","v5.15.132","v5.15.131","v5.15.130","v5.15.129","v5.15.128","v5.15.127","v5.15.126","v5.15.125","v5.15.124","v5.15.123","v5.15.122","v5.15.121","v5.15.120","v5.15.119","v5.15.118","v5.15.117","v5.15.116","v5.15.115","v5.15.114","v5.15.113","v5.15.112","v5.15.111","v5.15.110","v5.15.109","v5.15.108","v5.15.107","v5.15.106","v5.15.105","v5.15.104","v5.15.103","v5.15.102","v5.15.101","v5.15.100","v5.15.99","v5.15.98","v5.15.97","v5.15.96","v5.15.95","v5.15.94","v5.15.93","v5.15.92","v5.15.91","v5.15.90","v5.15.89","v5.15.88","v5.15.87","v5.15.86","v5.15.85","v5.15.84","v5.15.83","v5.15.82","v5.15.81","v5.15.80","v5.15.79","v5.15.78","v5.15.77","v5.15.76","v5.15.75","v5.15.74","v5.15.73","v5.15.72","v5.15.71","v5.15.70","v5.15.69","v5.15.68","v5.15.67","v5.15.66","v5.15.65","v5.15.64","v5.15.63","v5.15.62","v5.15.61","v5.15.60","v5.15.59","v5.15.58","v5.15.57","v5.15.56","v5.15.55","v5.15.54","v5.15.53","v5.15.52","v5.15.51","v5.15.50","v5.15.49","v5.15.48","v5.15.47","v5.15.46","v5.15.45","v5.15.44","v5.15.43","v5.15.42","v5.15.41","v4.19.325","v4.19.324","v4.19.323","v4.19.322","v4.19.321","v4.19.320","v4.19.319","v4.19.318","v4.19.317","v4.19.316","v4.19.315","v4.19.314","v4.19.313","v4.19.312","v4.19.311","v4.19.310","v4.19.309","v4.19.308","v4.19.307","v4.19.306","v4.19.305","v4.19.304","v4.19.303","v4.19.302","v4.19.301","v4.19.300","v4.19.299","v4.19.298","v4.19.297","v4.19.296","v4.19.295","v4.19.294","v4.19.293","v4.19.292","v4.19.291","v4.19.290","v4.19.289","v4.19.288","v4.19.287","v4.19.286","v4.19.285","v4.19.284","v4.19.283","v4.19.282","v4.19.281","v4.19.280","v4.19.279","v4.19.278","v4.19.277","v4.19.276","v4.19.275","v4.19.274","v4.19.273","v4.19.272","v4.19.271","v4.19.270","v4.19.269","v4.19.268","v4.19.267","v4.19.266","v4.19.265","v4.19.264","v4.19.263","v4.19.262","v4.19.261","v4.19.260","v4.19.259","v4.19.258","v4.19.257","v4.19.256","v4.19.255","v4.19.254","v4.19.253","v4.19.252","v4.19.251","v4.19.250","v4.19.249","v4.19.248","v4.19.247","v4.19.246","v4.19.245","v4.19.244","v5.4.302","v5.4.301","v5.4.300","v5.4.299","v5.4.298","v5.4.297","v5.4.296","v5.4.295","v5.4.294","v5.4.293","v5.4.292","v5.4.291","v5.4.290","v5.4.289","v5.4.288","v5.4.287","v5.4.286","v5.4.285","v5.4.284","v5.4.283","v5.4.282","v5.4.281","v5.4.280","v5.4.279","v5.4.278","v5.4.277","v5.4.276","v5.4.275","v5.4.274","v5.4.273","v5.4.272","v5.4.271","v5.4.270","v5.4.269","v5.4.268","v5.4.267","v5.4.266","v5.4.265","v5.4.264","v5.4.263","v5.4.262","v5.4.261","v5.4.260","v5.4.259","v5.4.258","v5.4.257","v5.4.256","v5.4.255","v5.4.254","v5.4.253","v5.4.252","v5.4.251","v5.4.250","v5.4.249","v5.4.248","v5.4.247","v5.4.246","v5.4.245","v5.4.244","v5.4.243","v5.4.242","v5.4.241","v5.4.240","v5.4.239","v5.4.238","v5.4.237","v5.4.236","v5.4.235","v5.4.234","v5.4.233","v5.4.232","v5.4.231","v5.4.230","v5.4.229","v5.4.228","v5.4.227","v5.4.226","v5.4.225","v5.4.224","v5.4.223","v5.4.222","v5.4.221","v5.4.220","v5.4.219","v5.4.218","v5.4.217","v5.4.216","v5.4.215","v5.4.214","v5.4.213","v5.4.212","v5.4.211","v5.4.210","v5.4.209","v5.4.208","v5.4.207","v5.4.206","v5.4.205","v5.4.204","v5.4.203","v5.4.202","v5.4.201","v5.4.200","v5.4.199","v5.4.198","v5.4.197","v5.4.196","v5.4.195","v5.17.15","v5.17.14","v5.17.13","v5.17.12","v5.17.11","v5.17.10","v5.17.9"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-46331.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.19.244"},{"fixed":"4.20"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.4.195"},{"fixed":"5.5"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.10.117"},{"fixed":"5.10.260"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.15.41"},{"fixed":"5.15.211"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.17.9"},{"fixed":"5.18"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.18.0"},{"fixed":"6.1.177"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.144"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.94"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.36"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.0.13"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-46331.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}