CVE-2026-46323: net: gro: don't merge zcopy skbs
In the Linux kernel, the following vulnerability has been resolved:
net: gro: don't merge zcopy skbs
skbgroreceive() can currently copy frags between the source and GRO skb, without checking the zerocopy status, and in particular the SKBFLMANAGEDFRAGREFS flag.
When SKBFLMANAGEDFRAGREFS is set, the skb doesn't hold a reference on the pages in shinfo->frags. Appending those frags to another skb's frags without fixing up the page refcount can lead to UAF.
When either the last skb in the GRO chain (the one we would append frags to) or the source skb is zerocopy, don't merge the skbs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.143.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.14-1 - Compensating control
In skb_gro_receive(), do not merge skbs when either the last skb in the GRO chain or the source skb is zerocopy, including when SKBFL_MANAGED_FRAG_REFS is set.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46323?
CVE-2026-46323 has a risk score of 57, indicating a moderate severity level.
How do I fix CVE-2026-46323?
To remediate CVE-2026-46323, update the Linux kernel to the latest stable version that includes the security patch.
What systems are affected by CVE-2026-46323?
CVE-2026-46323 affects the Linux kernel, specifically versions that utilize the gro (Generic Receive Offload) feature.
What vulnerabilities are related to CVE-2026-46323?
CVE-2026-46323 can be related to other vulnerabilities in the Linux kernel that involve memory management and network packet handling.
What changes were made to resolve CVE-2026-46323?
The resolution for CVE-2026-46323 involves preventing the merging of zerocopy skbs in the skb_gro_receive() function without proper checks.