CVE-2026-46323

HIGH EPSS 2.2%
Published Jun 9, 20263w ago · Modified Jun 19, 20261w ago
7.8 CVSS 3.1
High
Find Similar
Published Jun 9, 2026 3w ago
Last Modified Jun 19, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: net: gro: don't merge zcopy skbs skb_gro_receive() can currently copy frags between the source and GRO skb, without checking the zerocopy status, and in particular the SKBFL_MANAGED_FRAG_REFS flag. When SKBFL_MANAGED_FRAG_REFS is set, the skb doesn't hold a reference on the pages in shinfo->frags. Appending those frags to another skb's frags without fixing up the page refcount can lead to UAF. When either the last skb in the GRO chain (the one we would append frags to) or the source skb is zerocopy, don't merge the skbs.

CVSS Details

Base Score
7.8
Exploitability
1.8
Impact
5.9
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
2.2% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

References 6

  • git.kernel.org https://git.kernel.org/stable/c/1f9c828556416fbe3f49386708ce999fc4d4da06
  • git.kernel.org https://git.kernel.org/stable/c/3c6cc9f2ca65b6dd61b1af75452dc0e1cd0aad8d
  • git.kernel.org https://git.kernel.org/stable/c/44bea2032af0425e4ce6d26a8af0ede79db49ec1
  • git.kernel.org https://git.kernel.org/stable/c/479084ae0e1d9cb7929cb4298d35623de189f80a
  • git.kernel.org https://git.kernel.org/stable/c/4db79a322db8c97f7b73b8a347395ef4d685eb40
  • git.kernel.org https://git.kernel.org/stable/c/e334cbf3388fd9334503a778a82d9e9f14dd2f71

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.