CVE-2026-46331 — Kernel
HIGHCVE-2026-46331 is a high-severity (CVSS 7.8) CWE-190 vulnerability in Kernel. 5 public exploit references exist, so weaponization risk is real. A fix is available for Kernel — see the affected versions and patch details below.
net/sched: fix pedit partial COW leading to page cache corruption
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
- A successful exploit gives an attacker total control of the affected component, not partial access.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-46331.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2026-46331 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 385,386 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
KernelReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Linux packages — download data is not available via public APIs for these ecosystems.
Description
In the Linux kernel, the following vulnerability has been resolved:
net/sched: fix pedit partial COW leading to page cache corruption
tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd.
Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐧Linux | Kernel | ≥ 5.11.0&&< 5.10.260 | 5.10.260 |
Affected Products
linux kernellinuxResearch use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.
sgkdev/packet_edit_meme
PACKET_EDIT_MEME.c (aka CVE-2026-46331): yet another page cache poisonin
0xBlackash/CVE-2026-46331
CVE-2026-46331
rjt-gupta/page-cache-corruption-lpes
CVE-2026-46331 and CVE-2026-43503
vulnquest58/dirtyclone-exploit
CVE-2026-46331 — Linux Kernel Local Privilege Escalation TC pedit + IPse
yanxinwu946/CVE-2026-46331
CVE-2026-46331 act_pedit page-cache corruption exploit, with Alpine PIE
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for Kernel, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update Kernel to 5.10.260 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-46331 is resolved across your whole dependency graph.
Workarounds
Constrain what reaches the vulnerable code: limit the size and shape of untrusted input, isolate the affected component in a sandboxed or least-privileged process, and enable the platform's memory-safety mitigations (ASLR, stack protector, hardened allocator) so an out-of-bounds access is more likely to fail closed than to be exploitable.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
Red Hat rates this flaw as Important severity. This vulnerability is in the kernel's traffic control (tc) pedit action, which requires CAP_NET_ADMIN capability to configure. By default in Red Hat Enterprise Linux, this limits exploitation to the root user or processes explicitly granted network administration…
To mitigate this vulnerability, prevent the 'act_pedit' kernel module from loading. Create a file `/etc/modprobe.d/disable-act_pedit.conf` with the following content: `install act_pedit /bin/true` Then, regenerate the initramfs and reboot the system for the changes to take effect. This may impact network traffic control functionality that relies on the pedit action.Source: Red Hat security advisory for CVE-2026-46331 (CC BY 4.0)
| Product | Fixed in | Advisory |
|---|---|---|
| NVIDIA for RHEL 10 | kernel-0:6.12.0-212.11.el10nv | RHSA-2026:27709 |
| NVIDIA for RHEL 10 | kernel-0:6.12.0-231.13.el10nv | RHSA-2026:33666 |
| Red Hat Enterprise Linux 10 | kernel-0:6.12.0-211.26.1.el10_2 | RHSA-2026:27288 |
| Red Hat Enterprise Linux 10 | kpatch-patch | RHSA-2026:33225 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | kernel-0:6.12.0-55.82.1.el10_0 | RHSA-2026:27731 |
| Red Hat Enterprise Linux 8 | kernel-rt-0:4.18.0-553.136.1.rt7.477.el8_10 | RHSA-2026:27354 |
| Red Hat Enterprise Linux 8 | kernel-0:4.18.0-553.136.1.el8_10 | RHSA-2026:27353 |
| Red Hat Enterprise Linux 8 | kpatch-patch | RHSA-2026:33220 |
Frequently Asked Questions
Is CVE-2026-46331 in your dependencies?
Find it across Linux, including transitive dependencies.