{"id":"CVE-2026-46331","published":"2026-06-16T06:26:21Z","modified":"2026-10-15T01:21:40Z","title":"net/sched: fix pedit partial COW leading to page cache corruption","vendor":"Linux","product":"Linux","tier":"core","eol":null,"affectedVersions":[{"vendor":"Linux","product":"Linux","versions":[">= abe35bf3be51482593076d516a680d79e5fbc8e1, < 544d857b42a1734b923040e13aa61a6fd4746cf2",">= b773640d5bb9e2acfd91e2695717af04d47aa116, < d5d01d35a5a7d36f7cb679b67d9cbdd5205672dc",">= 8b796475fd7882663a870456466a4fb315cc1bd6, < a071e057518decc5e3bec89855758f5f8786f2c5",">= 8b796475fd7882663a870456466a4fb315cc1bd6, < b685d6ef6f07a3b5ce814565a25f39f2157538a5",">= 8b796475fd7882663a870456466a4fb315cc1bd6, < 2bec122b9fb91507a758ab5e3e5c4fbe7cb3f61b",">= 8b796475fd7882663a870456466a4fb315cc1bd6, < b198ed4e52580a7238c7c7082f03906f8b310313",">= 8b796475fd7882663a870456466a4fb315cc1bd6, < 3dee9d0c198faeb95d052c1b94c2958751a28512",">= 8b796475fd7882663a870456466a4fb315cc1bd6, < 899ee91156e57784090c5565e4f31bd7dbffbc5a","d0c38a914b0c4c21d553da801003d36979016726","2ec2dd7d51a9320151f275ddbb2b53260fb32ca1"]},{"vendor":"Linux","product":"Linux","versions":["5.18"]}],"description":{"text":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: fix pedit partial COW leading to page cache corruption\n\ntcf_pedit_act() computes the COW range for skb_ensure_writable()\nonce before the key loop using tcfp_off_max_hint, but the hint does\nnot account for the runtime header offset added by typed keys. This\ncan leave part of the write region un-COW'd.\n\nFix by moving skb_ensure_writable() inside the per-key loop where\nthe actual write offset is known, and add overflow checking on the\noffset arithmetic. For negative offsets (e.g. Ethernet header edits\nat ingress), use skb_cow() to COW the headroom instead. Guard\noffset_valid() against INT_MIN, where negation is undefined.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00639,"percentile":0.50573,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-08-26","exploitedFirstSeen":"2026-08-26","ransomware":false,"evidence":[{"url":"https://securelist.com/vulnerabilities-and-exploits-in-q2-2026/121091/","date":"2026-08-26"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":9,"pulses":[{"name":"Known_Cve | Jun 25, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a3be6dbb1f7cc62068aef9a","created":"2026-06-24"},{"name":"Known_Cve | Jun 24, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a3a950fc90afab1e30140fe","created":"2026-06-23"},{"name":"Known_Cve | Jun 23, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a394818937e0c7253e410db","created":"2026-06-22"},{"name":"Known_Cve | Jun 22, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a37f1eb3381ff44b8485150","created":"2026-06-21"},{"name":"Known_Cve | Jun 21, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a36a725b8694ad53fe97d62","created":"2026-06-20"},{"name":"Known_Cve | Jun 20, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a354f27fe806e1166e1cc7f","created":"2026-06-19"},{"name":"Known_Cve | Jun 19, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a33fd81e56054837362ca4a","created":"2026-06-18"},{"name":"Known_Cve | Jun 18, 2026 | Part 2/2","url":"https://otx.alienvault.com/pulse/6a32ac0491ef662e9b510acc","created":"2026-06-17"},{"name":"Known_Cve | Jun 17, 2026 | Part 2/2","url":"https://otx.alienvault.com/pulse/6a315a929d6d31edb346d9a4","created":"2026-06-16"}],"provenance":"machine"},"cwes":[{"id":"CWE-787","name":"Out-of-bounds Write"},{"id":"CWE-190","name":"Integer Overflow or Wraparound"}],"references":[{"url":"https://git.kernel.org/stable/c/544d857b42a1734b923040e13aa61a6fd4746cf2","tags":[]},{"url":"https://git.kernel.org/stable/c/d5d01d35a5a7d36f7cb679b67d9cbdd5205672dc","tags":[]},{"url":"https://git.kernel.org/stable/c/a071e057518decc5e3bec89855758f5f8786f2c5","tags":[]},{"url":"https://git.kernel.org/stable/c/b685d6ef6f07a3b5ce814565a25f39f2157538a5","tags":[]},{"url":"https://git.kernel.org/stable/c/2bec122b9fb91507a758ab5e3e5c4fbe7cb3f61b","tags":[]},{"url":"https://git.kernel.org/stable/c/b198ed4e52580a7238c7c7082f03906f8b310313","tags":[]},{"url":"https://git.kernel.org/stable/c/3dee9d0c198faeb95d052c1b94c2958751a28512","tags":[]},{"url":"https://git.kernel.org/stable/c/899ee91156e57784090c5565e4f31bd7dbffbc5a","tags":[]},{"url":"https://github.com/sgkdev/packet_edit_meme/tree/main","tags":["exploit"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-46331","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479492","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46331.json","tags":["x_sadp-csaf-vex"]},{"url":"https://access.redhat.com/errata/RHSA-2026:27709","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:33666","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34048","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:40021","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:28887","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:28962","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:29080","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34098","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:29856","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:29863","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:29799","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:29833","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:29794","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:27731","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:27288","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:27705","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:27713","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:27708","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:27789","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:33225","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:27353","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:33220","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:27707","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:27704","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:27355","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:33219","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:33221","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:33222","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:33223","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:33224","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:27354","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:27706","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-37039","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-37039","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":13,"skipped":1,"earliest":"2026-06-17","earliestUrl":"https://github.com/sgkdev/packet_edit_meme","repos":[{"name":"sgkdev/packet_edit_meme","url":"https://github.com/sgkdev/packet_edit_meme","stars":147,"created":"2026-06-17"},{"name":"0xredash/CVE-2026-46331","url":"https://github.com/0xredash/CVE-2026-46331","stars":38,"created":"2026-06-26"},{"name":"rjt-gupta/page-cache-corruption-lpes","url":"https://github.com/rjt-gupta/page-cache-corruption-lpes","stars":13,"created":"2026-07-22"},{"name":"vulnquest58/dirtyclone-exploit","url":"https://github.com/vulnquest58/dirtyclone-exploit","stars":7,"created":"2026-06-28"},{"name":"yanxinwu946/CVE-2026-46331","url":"https://github.com/yanxinwu946/CVE-2026-46331","stars":5,"created":"2026-07-11"}]},"first":{"date":"2026-06-17","source":"PoC-in-GitHub","url":"https://github.com/sgkdev/packet_edit_meme"},"provenance":"source"},"exploitRefs":["https://github.com/sgkdev/packet_edit_meme/tree/main"],"flow":[],"timeline":[{"date":"2026-06-16","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2026-46331","provenance":"source"},{"date":"2026-06-17","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/sgkdev/packet_edit_meme","provenance":"source"},{"date":"2026-08-26","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://securelist.com/vulnerabilities-and-exploits-in-q2-2026/121091/","provenance":"source"}],"speed":{"daysToPublicExploit":1,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":67.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":10.0,"detail":"added 66 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":10.11,"detail":"percentile 0.5057"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 13 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":2.27,"detail":"9 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}