Executive brief
A vulnerability in the Linux kernel's networking subsystem could allow for page cache corruption. This occurs when the system incorrectly handles memory during packet header modifications, potentially leading to system instability or data integrity issues. The flaw affects the 'pedit' action used in network traffic scheduling and filtering.
Technical details
A vulnerability in tcf_pedit_act() in the Linux kernel's traffic control (tc) subsystem stems from an incorrect calculation of the Copy-on-Write (COW) range. The function originally computed the COW range once using a static hint (tcfp_off_max_hint) that failed to account for runtime header offsets added by typed keys. This could result in write operations occurring on memory regions that were not properly COWed, leading to page cache corruption. The fix involves moving skb_ensure_writable() inside the per-key loop to ensure the actual write offset is known and validated, adding overflow checks, and using skb_cow() for negative offsets (such as Ethernet header edits at ingress).
Affected products
- Linux Linux Kernel Fixed in commit 899ee91156e57784090c5565e4f31bd7dbffbc5a
Timeline
- 2026-05-31: other: Patch authored
- 2026-06-04: patched: Patch committed to stable tree
- 2026-06-16: disclosed: CVE published