Linux Kernel net/sched Partial COW Page Cache Corruption (CVE-2026-46331)

act_pedit skb_ensure_writable() computes COW range before runtime offsets — page cache corruption, potential LPE, CVSS 7.8.

Summary

CVE-2026-46331 is a Linux kernel memory-corruption flaw in the net/sched packet editing (act_pedit) subsystem (kernel.org CNA CVSS 7.8). 0xBlackash/CVE-2026-46331 demonstrates the partial Copy-on-Write primitive.

tcf_pedit_act() calls skb_ensure_writable() once before its key loop, sizing the COW window from tcfp_off_max_hint. Typed pedit keys then add a runtime header offset that the hint does not cover, so part of the write region stays mapped to the original page. Ingress edits with negative offsets (e.g. Ethernet header) widen the gap because headroom was never COW'd. Writes past the copied span corrupt page cache and can crash the host or yield an LPE primitive under favorable conditions.

OFFSITE.DARK did not author the PoC.

Key Findings

Finding	Detail
CVE	CVE-2026-46331
Component	Linux kernel `net/sched/act_pedit.c` → `tcf_pedit_act()`
Weakness	CWE-787 / CWE-190 — partial COW; writable range sized before runtime header offsets
Impact	Out-of-bounds write into page cache; crashes; potential LPE
Attack vector	Local — `tc` pedit rules (`CAP_NET_ADMIN`, or user namespaces where `tc` is exposed)
CVSS	7.8 (kernel.org CNA, PR:L); Red Hat ADP 6.7 (PR:H)
Remote vector	None
Fix	Per-key `skb_ensure_writable()`; overflow checks; `skb_cow()` for negative offsets; `offset_valid()` guards `INT_MIN`

Attack Chain

Attacker with CAP_NET_ADMIN (or user-ns) configures tc pedit rules
        ↓
tcf_pedit_act() calls skb_ensure_writable() once (stale range)
        ↓
Runtime header offsets shift actual write target
        ↓
Write beyond COW-copied region → page cache corruption
        ↓
Kernel crash or LPE primitive (conditions-dependent)

Impact

Container and bare-metal hosts that allow unprivileged user namespaces plus tc manipulation face elevated risk. Even without full LPE, corruption can crash production nodes running traffic-shaping rules.

Mitigation

Install a patched kernel (upstream fix moves skb_ensure_writable() per key with integer overflow validation).
Restrict CAP_NET_ADMIN and disable unprivileged user namespaces where not required.
Audit and remove unnecessary tc pedit rules; reboot after kernel upgrade.

Related Signals

Sources

→ Source