In the Linux kernel, the following vulnerability has been resolved:

net/sched: fix pedit partial COW leading to page cache corruption

tcf_pedit_act() computes the COW range for skb_ensure_writable()
once before the key loop using tcfp_off_max_hint, but the hint does
not account for the runtime header offset added by typed keys. This
can leave part of the write region un-COW'd.

Fix by moving skb_ensure_writable() inside the per-key loop where
the actual write offset is known, and add overflow checking on the
offset arithmetic. For negative offsets (e.g. Ethernet header edits
at ingress), use skb_cow() to COW the headroom instead. Guard
offset_valid() against INT_MIN, where negation is undefined.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00525.

Exploitation poc

Automatable no

Technical Impact total

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
abe35bf3be51482593076d516a680d79e5fbc8e1 affected < 544d857b42a1734b923040e13aa61a6fd4746cf2
b773640d5bb9e2acfd91e2695717af04d47aa116 affected < d5d01d35a5a7d36f7cb679b67d9cbdd5205672dc
8b796475fd7882663a870456466a4fb315cc1bd6 affected < a071e057518decc5e3bec89855758f5f8786f2c5
8b796475fd7882663a870456466a4fb315cc1bd6 affected < b685d6ef6f07a3b5ce814565a25f39f2157538a5
8b796475fd7882663a870456466a4fb315cc1bd6 affected < 2bec122b9fb91507a758ab5e3e5c4fbe7cb3f61b
8b796475fd7882663a870456466a4fb315cc1bd6 affected < b198ed4e52580a7238c7c7082f03906f8b310313
8b796475fd7882663a870456466a4fb315cc1bd6 affected < 3dee9d0c198faeb95d052c1b94c2958751a28512
8b796475fd7882663a870456466a4fb315cc1bd6 affected < 899ee91156e57784090c5565e4f31bd7dbffbc5a
d0c38a914b0c4c21d553da801003d36979016726 affected —
2ec2dd7d51a9320151f275ddbb2b53260fb32ca1 affected —
c19cc520b3d69904e9518d401ad0df7f4702aca0 affected —
5.10.117 affected < 5.10.260
5.15.41 affected < 5.15.211
4.19.244 affected < 4.20
5.4.195 affected < 5.5
5.17.9 affected < 5.18
Linux Linux affected
Version Status Constraints
5.18 affected —
0 unaffected < 5.18
5.10.260 unaffected ≤ 5.10.*
5.15.211 unaffected ≤ 5.15.*
6.1.177 unaffected ≤ 6.1.*
6.6.144 unaffected ≤ 6.6.*
6.12.94 unaffected ≤ 6.12.*
6.18.36 unaffected ≤ 6.18.*
7.0.13 unaffected ≤ 7.0.*
7.1 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Linux Subscribe
Linux Kernel Subscribe

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories
Source ID Title
Debian DLA Debian DLA DLA-4665-1 linux security update
Debian DLA Debian DLA DLA-4671-1 linux-6.1 security update
Debian DSA Debian DSA DSA-6355-1 linux security update
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/2bec122b9fb91507a758ab5e3e5c4fbe7cb3f61b cve-icon
https://git.kernel.org/stable/c/3dee9d0c198faeb95d052c1b94c2958751a28512 cve-icon
https://git.kernel.org/stable/c/544d857b42a1734b923040e13aa61a6fd4746cf2 cve-icon
https://git.kernel.org/stable/c/899ee91156e57784090c5565e4f31bd7dbffbc5a cve-icon cve-icon
https://git.kernel.org/stable/c/a071e057518decc5e3bec89855758f5f8786f2c5 cve-icon
https://git.kernel.org/stable/c/b198ed4e52580a7238c7c7082f03906f8b310313 cve-icon
https://git.kernel.org/stable/c/b685d6ef6f07a3b5ce814565a25f39f2157538a5 cve-icon
https://git.kernel.org/stable/c/d5d01d35a5a7d36f7cb679b67d9cbdd5205672dc cve-icon
https://github.com/sgkdev/packet_edit_meme/tree/main cve-icon
History

Sat, 04 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
References

Mon, 29 Jun 2026 16:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119

Mon, 29 Jun 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-190
CWE-787
References
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sun, 28 Jun 2026 13:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119

Sun, 28 Jun 2026 10:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-122
CWE-787

Sun, 28 Jun 2026 08:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Fri, 19 Jun 2026 12:45:00 +0000

Type Values Removed Values Added
References

Thu, 18 Jun 2026 04:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-122
CWE-787

Tue, 16 Jun 2026 08:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.
Title net/sched: fix pedit partial COW leading to page cache corruption
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-07-23T12:08:07.840Z

Reserved: 2026-05-13T15:03:33.112Z

Link: CVE-2026-46331

cve-icon Vulnrichment

Updated: 2026-07-23T12:08:07.840Z

cve-icon NVD

Status : Received

Published: 2026-06-16T08:16:23.993

Modified: 2026-06-16T08:16:23.993

Link: CVE-2026-46331

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-29T17:30:06Z

Weaknesses