High · published June 16, 2026
In the Linux kernel, the following vulnerability has been resolved:
net/sched: fix pedit partial COW leading to page cache corruption
tcf_pedit_act() computes the COW range for skb_ensure_writable()
once before the key loop using tcfp_off_max_hint, but the hint does
not account for the runtime header offset added by typed keys. This
can leave part of the write region un-COW'd.
Fix by moving skb_ensure_writable() inside the per-key loop where
the actual write offset is known, and add overflow checking on the
offset arithmetic. For negative offsets (e.g. Ethernet header edits
at ingress), use skb_cow() to COW the headroom instead. Guard
offset_valid() against INT_MIN, where negation is undefined.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 4.19.244, < 4.20 | 4.20 |
| linux/linux_kernel | ≥ 5.4.195, < 5.5 | 5.5 |
| linux/linux_kernel | ≥ 5.10.117, < 5.11 | 5.11 |
| linux/linux_kernel | ≥ 5.15.41, < 5.16 | 5.16 |
| linux/linux_kernel | ≥ 5.17.9, < 5.18 | 5.18 |
| linux/linux_kernel | ≥ 5.18.1, < 6.12.94 | 6.12.94 |
| linux/linux_kernel | ≥ 6.13, < 6.18.36 | 6.18.36 |
| linux/linux_kernel | ≥ 6.19, < 7.0.13 | 7.0.13 |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |