CVE-2026-46331

High · CVSS 7.8

Linux Kernel — Integer overflow and out-of-bounds write (CWE-190, CWE-787) in net/sched pedit partial COW leading to page cache corruption

CVSS: 7.8; nvd
EPSS: 0.32%; 24th pct
KEV: No
Class: oss containerizable; CWE-190, CWE-787, CWE-787

Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.

Search profile — drives PoC discovery

Symbols tcf_pedit_actskb_ensure_writabletcfp_off_max_hintskb_cowoffset_validtcf_peditnet/schedpedit

Keywords CVE-2026-46331Linux kernel pedit COWtcf_pedit_act skb_ensure_writablenet/sched pedit page cache corruptionpedit partial COW overflowtcfp_off_max_hint overflowskb_cow headroom pedit ingressoffset_valid INT_MINLinux kernel sched pedit OOB write

Versions: Unpatched commits prior to: 2bec122b9fb9, 3dee9d0c198f, 544d857b42a1, 899ee91156e5, a071e057518d

Ranked PoCs (11) — best first

Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.

sgkdev/packet_edit_meme needs review

cited in references · recent activity

gh_search · C

★ 133
vulnquest58/dirtyclone-exploit needs review

recent activity

gh_search · C

★ 5
douglasmun/pagecache-lpe-containment-kit needs review

recent activity

gh_search · Shell

★ 2
yanxinwu946/CVE-2026-46331 needs review

recent activity

gh_search · C

★ 2
Quaerendir/cve-2026-46331-audit needs review

recent activity

gh_search · Shell

★ 0
g0thamRabb1t/CVE-2026-46331-pedit-COW-detection needs review

recent activity

gh_search

★ 0
0xBlackash/CVE-2026-46331 needs review

recent activity

gh_search · C

★ 25
aexdyhaxor/CVE-2026-46331 needs review

recent activity

gh_search · C

★ 2
HORKimhab/CVE-2026-46331 needs review

recent activity

gh_search

★ 0
V0IDNETWORK/CVE-2026-46331 needs review

recent activity

gh_search · C++

★ 0
seguridadentrerios/CVE-2026-46331 needs review

recent activity

gh_search · Shell

★ 0

Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.

Affected packages

Linux	Kernel	0 → 5.10.260
Linux	Kernel	5.11.0 → 5.15.211
Linux	Kernel	5.16.0 → 6.1.177
Linux	Kernel	5.18.0 → 6.6.144
Linux	Kernel	6.13.0 → 7.0.13
Linux	Kernel	6.2.0 → 6.12.94
Linux	Kernel	6.7.0 → 6.18.36

References

Status: enriched · ingested 2026-07-10T18:00:26.000Z · profiled 2026-07-10T18:30:26.000Z