IM
IronMonkey Threat Research

CVE-2026-46323 HIGH

Published: 2026-06-09 | Last Modified: 2026-09-08 | Status: Modified

Description

In the Linux kernel, the following vulnerability has been resolved: net: gro: don't merge zcopy skbs skb_gro_receive() can currently copy frags between the source and GRO skb, without checking the zerocopy status, and in particular the SKBFL_MANAGED_FRAG_REFS flag. When SKBFL_MANAGED_FRAG_REFS is set, the skb doesn't hold a reference on the pages in shinfo->frags. Appending those frags to another skb's frags without fixing up the page refcount can lead to UAF. When either the last skb in the GRO chain (the one we would append frags to) or the source skb is zerocopy, don't merge the skbs.

Additional Descriptions (1)

En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: net: gro: no fusionar skbs zcopy skb_gro_receive() actualmente puede copiar fragmentos entre el skb de origen y el GRO, sin verificar el estado de zerocopy, y en particular el indicador SKBFL_MANAGED_FRAG_REFS. Cuando SKBFL_MANAGED_FRAG_REFS está establecido, el skb no mantiene una referencia en las páginas en shinfo->frags. Adjuntar esos fragmentos a los fragmentos de otro skb sin corregir el recuento de referencias de la página puede llevar a UAF. Cuando el último skb en la cadena GRO (aquel al que adjuntaríamos fragmentos) o el skb de origen es zerocopy, no fusionar los skbs.

CVSS Metrics

Base Score: 7.8 (HIGH)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack VectorLOCAL
Attack ComplexityLOW
Privileges RequiredLOW
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactHIGH
Integrity ImpactHIGH
Availability ImpactHIGH

Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Type: Secondary

Exploitability Score: 1.8

Impact Score: 5.9

Weaknesses

Source Type Description
[email protected] Primary
en CWE-416
0b0ca135-0b70-47e7-9f44-1890c2a1c46c Secondary
en CWE-123

Affected Products

Vendor Product Version Update Type
linux linux_kernel * <built-in method update of dict object at 0x7d23af202600> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7d23a536f9c0> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7d24246ec500> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7d23a536fe40> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7d23af201400> Operating System
linux linux_kernel 7.1 <built-in method update of dict object at 0x7d23af2035c0> Operating System
linux linux_kernel 7.1 <built-in method update of dict object at 0x7d239fb11980> Operating System
linux linux_kernel 7.1 <built-in method update of dict object at 0x7d23a5338a80> Operating System
linux linux_kernel 7.1 <built-in method update of dict object at 0x7d239fb10640> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*

References

Notification
Message here