Linux Linux Kernel Integer Overflow Rated 7.8 CVSS

Status: UPDATED  |  Advisory ID: CVE-2026-46331

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

net/sched: fix pedit partial COW leading to page cache corruption

tcf_pedit_act() computes the COW range for skb_ensure_writable()

once before the key loop using tcfp_off_max_hint, but the hint does

not account for the runtime header offset added by typed keys. This

can leave part of the write region un-COW'd.

Fix by moving skb_ensure_writable() inside the per-key loop where

the actual write offset is known, and add overflow checking on the

offset arithmetic. For negative offsets (e.g. Ethernet header edits

at ingress), use skb_cow() to COW the headroom instead. Guard

offset_valid() against INT_MIN, where negation is undefined. (NVD)

What to Do

Monitor Linux, Red Hat, and Siemens's web pages for any future patch releases.

References