CVE-2026-46331 — net/sched: fix pedit partial COW leading to page cache corruption

Affected: Linux, Red Hat NVIDIA for RHEL 10, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.8 Telecommunications Update Service and 19 more

In the Linux kernel, the following vulnerability has been resolved:

net/sched: fix pedit partial COW leading to page cache corruption

tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd.

Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.

USN-8629-1 — linux, linux-aws, linux-azure, linux-azure-fde, linux-ibm, linux-oracle, linux-raspi, linux-realtime vulnerabilities

Affected: Ubuntu:26.04:LTS: linux, Ubuntu:26.04:LTS: linux-aws, Ubuntu:26.04:LTS: linux-azure, Ubuntu:26.04:LTS: linux-azure-fde, Ubuntu:26.04:LTS: linux-ibm, Ubuntu:26.04:LTS: linux-oracle, Ubuntu:26.04:LTS: linux-raspi, Ubuntu:26.04:LTS: linux-realtime

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - x86 architecture; - InfiniBand drivers; - Network drivers; - Network traffic control; - IPv4 networking; - IPv6 networking; - Netfilter; - RxRPC session sockets; - SCTP protocol; (CVE-2026-46331, CVE-2026-52924, CVE-2026-53131, CVE-2026-53151, CVE-2026-53175, CVE-2026-53176, CVE-2026-53186, CVE-2026-53212, CVE-2026-53215, CVE-2026-53216, CVE-2026-53221, CVE-2026-53224, CVE-2026-53225, CVE-2026-53228, CVE-2026-53246, CVE-2026-53247, CVE-2026-53260, CVE-2026-53359)

Most recent entries from all

CVE-2026-46331 — net/sched: fix pedit partial COW leading to page cache corruption

USN-8629-1 — linux, linux-aws, linux-azure, linux-azure-fde, linux-ibm, linux-oracle, linux-raspi, linux-realtime vulnerabilities