CVE-2026-46323: net: gro: don't merge zcopy skbs
In the Linux kernel, the following vulnerability has been resolved:
net: gro: don't merge zcopy skbs
skbgroreceive() can currently copy frags between the source and GRO skb, without checking the zerocopy status, and in particular the SKBFLMANAGEDFRAGREFS flag.
When SKBFLMANAGEDFRAGREFS is set, the skb doesn't hold a reference on the pages in shinfo->frags. Appending those frags to another skb's frags without fixing up the page refcount can lead to UAF.
When either the last skb in the GRO chain (the one we would append frags to) or the source skb is zerocopy, don't merge the skbs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.143.1-1 - Configuration
Ensure the GRO code uses the SKBFL_MANAGED_FRAG_REFS flag so that the skb doesn't hold a reference (per the resolved vulnerability behavior).
Linux kernel GRO (net: gro) SKBFL_MANAGED_FRAG_REFS flag = set/enable - Configuration
Modify skb_gro_receive() / GRO frag-merge so that when either the last skb in the GRO chain (the skb you would append frags to) or the source skb is zerocopy, the skbs are not merged (to prevent UAF from un-fixed page refcounts on shinfo->frags).
Linux kernel GRO (net: gro) GRO frag merging policy for zerocopy SKBs = do not merge zerocopy skbs / do not merge when last skb in GRO chain is zerocopy or when source skb is zerocopy
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46323?
CVE-2026-46323 has a risk score of 57, indicating a moderate severity level.
How do I fix CVE-2026-46323?
To remediate CVE-2026-46323, update the Linux kernel to the latest stable version that includes the security patch.
What systems are affected by CVE-2026-46323?
CVE-2026-46323 affects the Linux kernel, specifically versions that utilize the gro (Generic Receive Offload) feature.
What vulnerabilities are related to CVE-2026-46323?
CVE-2026-46323 can be related to other vulnerabilities in the Linux kernel that involve memory management and network packet handling.
What changes were made to resolve CVE-2026-46323?
The resolution for CVE-2026-46323 involves preventing the merging of zerocopy skbs in the skb_gro_receive() function without proper checks.