CVE-2026-46331: net/sched: fix pedit partial COW leading to page cache corruption
- Is it exploited?
Reported, not confirmed by CISA. VulnCheck KEV lists it as exploited in the wild. CISA has not added it to its Known Exploited Vulnerabilities catalog as of .
VulnCheck KEV lists it since . It cites 1 public report, the first from .
- How likely is exploitation in the next 30 days?
- 0.6%
EPSS score, percentile 50.6 of all scored records. A probability estimated by FIRST, not a report of exploitation.
CISA's SSVC assessment in the CVE record lists exploitation as poc.
- How severe?
- 7.8 High
CVSS v3.1 base score, given by the CNA
- What should I do?
CISA has set no required action, because the vulnerability is not in KEV.
The CVE record links no vendor advisory, patch or mitigation.
- Which versions are affected?
Affected
- from 5.10.117 to before 5.10.260
- 5.18
Unaffected before 5.18; 5.10.260; 5.15.211; 6.1.177; 6.6.144; 6.12.94; and 3 more
Source: CISA KEV 2026.10.29, as of ; VulnCheck KEV, as of ; FIRST EPSS, as of ; CVE List, as of . About the data.
Description
net/sched: fix pedit partial COW leading to page cache corruption
In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.
Source: CVE List, as of . About the data.
What to do
Advisories and patches
The CVE record links no vendor advisory, patch or mitigation.
This summary is based on the CVE record as of . Check the vendor's advisory before you act: affected versions and fixes can change.
Affected products and versions
Versions by product, as listed in the CVE record (2 products)
| Status | Versions |
|---|---|
| Affected | from abe35bf3be51 to before 544d857b42a1 |
| Affected | from b773640d5bb9 to before d5d01d35a5a7 |
| Affected | from 8b796475fd78 to before a071e057518d |
| Affected | from 8b796475fd78 to before b685d6ef6f07 |
| Affected | from 8b796475fd78 to before 2bec122b9fb9 |
| Affected | from 8b796475fd78 to before b198ed4e5258 |
| Affected | from 8b796475fd78 to before 3dee9d0c198f |
| Affected | from 8b796475fd78 to before 899ee91156e5 |
| Affected | d0c38a914b0c |
| Affected | 2ec2dd7d51a9 |
| Affected | c19cc520b3d6 |
| Affected | from 5.10.117 to before 5.10.260 |
Versions not listed are: unaffected.
And 4 more version entries in the CVE record.
| Status | Versions |
|---|---|
| Affected | 5.18 |
| Unaffected | before 5.18 |
| Unaffected | 5.10.260 |
| Unaffected | 5.15.211 |
| Unaffected | 6.1.177 |
| Unaffected | 6.6.144 |
| Unaffected | 6.12.94 |
| Unaffected | 6.18.36 |
| Unaffected | 7.0.13 |
| Unaffected | 7.1 |
Versions not listed are: affected.
Versions the record lists as unaffected: 5.10.260, 5.15.211, 6.1.177, 6.6.144, 6.12.94, 6.18.36, 7.0.13, 7.1.
Source: CVE List, as of . About the data.
Weakness
CWE-787, CWE-190
CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record.
Timeline
| Date | Event |
|---|---|
| CVE record published | |
| CVE record last updated |
References
8
Known exploited Linux vulnerabilities
- CVE-2026-46300: Linux Kernel Missing Initialization of a Variable Vulnerability
- CVE-2025-39682: Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability
- CVE-2025-39964: Linux Kernel Race Condition Vulnerability
- CVE-2026-53266: Linux Kernel Out-of-Bounds Write Vulnerability
- CVE-2026-53362: Linux Kernel Unspecified Vulnerability