CVE-2026-46323

Severity CVSS v4.0:

Pending analysis

Type:

CWE-416 Use After Free

Publication date:

09/06/2026

Last modified:

23/07/2026

Description

In the Linux kernel, the following vulnerability has been resolved: net: gro: don&#39;t merge zcopy skbs skb_gro_receive() can currently copy frags between the source and GRO skb, without checking the zerocopy status, and in particular the SKBFL_MANAGED_FRAG_REFS flag. When SKBFL_MANAGED_FRAG_REFS is set, the skb doesn&#39;t hold a reference on the pages in shinfo->frags. Appending those frags to another skb&#39;s frags without fixing up the page refcount can lead to UAF. When either the last skb in the GRO chain (the one we would append frags to) or the source skb is zerocopy, don&#39;t merge the skbs.

Impact

Vector 3.x

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS v3.1 Severity and Metrics:

Base Score: 7.80 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): High
Integrity (I): High
Availability (A): High

Base Score 3.x

7.80

Severity 3.x

HIGH

Vulnerable products and versions

CPE	From	Up to
cpe:2.3:o:linux:linux_kernel::::::::	6.0 (including)	6.1.176 (excluding)
cpe:2.3:o:linux:linux_kernel::::::::	6.2 (including)	6.6.142 (excluding)
cpe:2.3:o:linux:linux_kernel::::::::	6.7 (including)	6.12.92 (excluding)
cpe:2.3:o:linux:linux_kernel::::::::	6.13 (including)	6.18.34 (excluding)
cpe:2.3:o:linux:linux_kernel::::::::	6.19 (including)	7.0.11 (excluding)
cpe:2.3:o:linux:linux_kernel:7.1:rc1::::::
cpe:2.3:o:linux:linux_kernel:7.1:rc2::::::
cpe:2.3:o:linux:linux_kernel:7.1:rc3::::::
cpe:2.3:o:linux:linux_kernel:7.1:rc4::::::

To consult the complete list of CPE names with products and versions, see this page

CVE-2026-46323

Description

Impact

Vulnerable products and versions

References to Advisories, Solutions, and Tools