CVE-2026-46331 net/sched: fix pedit partial COW leading to page cache corruption

🗓️ 16 Jun 2026 06:26:21Reported by LinuxType

Fix pedit partial copy-on-write to prevent page cache corruption by moving writable check inside loop.

Reporter	Title	Published	Views	Family All 184
GithubExploit	Exploitarium-Detections	28 Jun 202621:36	–	githubexploit
GithubExploit	Exploit for CVE-2026-46331	30 Jun 202610:55	–	githubexploit
GithubExploit	Exploit for CVE-2026-46331	29 Jun 202623:04	–	githubexploit
GithubExploit	Exploit for CVE-2026-46331	1 Jul 202602:19	–	githubexploit
GithubExploit	Exploit for CVE-2026-46331	27 Jun 202603:54	–	githubexploit
GithubExploit	Exploit for CVE-2026-46331	30 Jun 202618:29	–	githubexploit
GithubExploit	pagecache-lpe-containment-kit	27 Jun 202614:23	–	githubexploit
GithubExploit	dirtyclone-exploit	28 Jun 202611:24	–	githubexploit
GithubExploit	Exploit for CVE-2026-46331	26 Jun 202618:57	–	githubexploit
ATTACKERKB	CVE-2026-46331	16 Jun 202606:26	–	attackerkb

[
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "unaffected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "include/net/tc_act/tc_pedit.h",
      "net/sched/act_pedit.c"
    ],
    "versions": [
      {
        "version": "abe35bf3be51482593076d516a680d79e5fbc8e1",
        "lessThan": "544d857b42a1734b923040e13aa61a6fd4746cf2",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "b773640d5bb9e2acfd91e2695717af04d47aa116",
        "lessThan": "d5d01d35a5a7d36f7cb679b67d9cbdd5205672dc",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "8b796475fd7882663a870456466a4fb315cc1bd6",
        "lessThan": "a071e057518decc5e3bec89855758f5f8786f2c5",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "8b796475fd7882663a870456466a4fb315cc1bd6",
        "lessThan": "b685d6ef6f07a3b5ce814565a25f39f2157538a5",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "8b796475fd7882663a870456466a4fb315cc1bd6",
        "lessThan": "2bec122b9fb91507a758ab5e3e5c4fbe7cb3f61b",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "8b796475fd7882663a870456466a4fb315cc1bd6",
        "lessThan": "b198ed4e52580a7238c7c7082f03906f8b310313",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "8b796475fd7882663a870456466a4fb315cc1bd6",
        "lessThan": "3dee9d0c198faeb95d052c1b94c2958751a28512",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "8b796475fd7882663a870456466a4fb315cc1bd6",
        "lessThan": "899ee91156e57784090c5565e4f31bd7dbffbc5a",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "d0c38a914b0c4c21d553da801003d36979016726",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "2ec2dd7d51a9320151f275ddbb2b53260fb32ca1",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "c19cc520b3d69904e9518d401ad0df7f4702aca0",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "5.10.117",
        "lessThan": "5.10.260",
        "status": "affected",
        "versionType": "semver"
      },
      {
        "version": "5.15.41",
        "lessThan": "5.15.211",
        "status": "affected",
        "versionType": "semver"
      },
      {
        "version": "4.19.244",
        "lessThan": "4.20",
        "status": "affected",
        "versionType": "semver"
      },
      {
        "version": "5.4.195",
        "lessThan": "5.5",
        "status": "affected",
        "versionType": "semver"
      },
      {
        "version": "5.17.9",
        "lessThan": "5.18",
        "status": "affected",
        "versionType": "semver"
      }
    ]
  },
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "affected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "include/net/tc_act/tc_pedit.h",
      "net/sched/act_pedit.c"
    ],
    "versions": [
      {
        "version": "5.18",
        "status": "affected"
      },
      {
        "version": "0",
        "lessThan": "5.18",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "5.10.260",
        "lessThanOrEqual": "5.10.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "5.15.211",
        "lessThanOrEqual": "5.15.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.1.177",
        "lessThanOrEqual": "6.1.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.6.144",
        "lessThanOrEqual": "6.6.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.12.94",
        "lessThanOrEqual": "6.12.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.18.36",
        "lessThanOrEqual": "6.18.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "7.0.13",
        "lessThanOrEqual": "7.0.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "7.1",
        "lessThanOrEqual": "*",
        "status": "unaffected",
        "versionType": "original_commit_for_fix"
      }
    ]
  }
]

Source	Link
git	www.git.kernel.org/stable/c/b198ed4e52580a7238c7c7082f03906f8b310313
git	www.git.kernel.org/stable/c/3dee9d0c198faeb95d052c1b94c2958751a28512
git	www.git.kernel.org/stable/c/a071e057518decc5e3bec89855758f5f8786f2c5
git	www.git.kernel.org/stable/c/2bec122b9fb91507a758ab5e3e5c4fbe7cb3f61b
git	www.git.kernel.org/stable/c/544d857b42a1734b923040e13aa61a6fd4746cf2
git	www.git.kernel.org/stable/c/d5d01d35a5a7d36f7cb679b67d9cbdd5205672dc
git	www.git.kernel.org/stable/c/b685d6ef6f07a3b5ce814565a25f39f2157538a5
git	www.git.kernel.org/stable/c/899ee91156e57784090c5565e4f31bd7dbffbc5a

04 Jul 2026 11:50Current

CVSS 3.17.8

EPSS0.00321