CVE-2026-46323 Details
Description
In the Linux kernel, the following vulnerability has been resolved: net: gro: don't merge zcopy skbs skb_gro_receive() can currently copy frags between the source and GRO skb, without checking the zerocopy status, and in particular the SKBFL_MANAGED_FRAG_REFS flag. When SKBFL_MANAGED_FRAG_REFS is set, the skb doesn't hold a reference on the pages in shinfo->frags. Appending those frags to another skb's frags without fixing up the page refcount can lead to UAF. When either the last skb in the GRO chain (the one we would append frags to) or the source skb is zerocopy, don't merge the skbs.
A vulnerability in the Linux kernel's Generic Receive Offload (GRO) handling can lead to a use-after-free condition. The issue arises because the GRO function can merge packet fragments from zero-copy sockets without properly managing the reference counts of the underlying memory pages. This flaw is present in the stable Linux kernel and affects several versions. When the last packet in the GRO chain or the source packet is zero-copy, the packets should not be merged. The vulnerability has been addressed by modifying the GRO function to check the zero-copy status before merging packets.
Users should upgrade to the latest version of the Linux kernel where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
| CWE-123 | Write-what-where Condition | redhat-SADP |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.0, < 6.1.176 >= 6.2, < 6.6.142 >= 6.7, < 6.12.92 >= 6.13, < 6.18.34 >= 6.19, < 7.0.11 7.1 rc1 7.1 rc2 7.1 rc3 7.1 rc4 |
CPE
Remediation
| |
Change History
18 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 8, 2026 | CVE Modified | siemens-SADP |
| Sep 3, 2026 | CVE Modified | redhat-SADP |
| Sep 1, 2026 | CVE Modified | kernel.org |
| Sep 1, 2026 | CVE Modified | redhat-SADP |
| Aug 24, 2026 | CVE Modified | redhat-SADP |
| Aug 7, 2026 | CVE Modified | redhat-SADP |
| Jul 30, 2026 | CVE Modified | redhat-SADP |
| Jul 29, 2026 | CVE Modified | redhat-SADP |
| Jul 23, 2026 | CVE Modified | redhat-SADP |
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jul 8, 2026 | Initial Analysis | [email protected] |
| Jul 7, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 19, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 14, 2026 | CVE Modified | kernel.org |
| Jun 9, 2026 | New CVE Received | kernel.org |