Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-46323— net: gro: don't merge zcopy skbs

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于skb_gro_receive()函数在复制frags时未检查零拷贝状态，可能导致释放后重用。

CVSS 7.8 · High EPSS 0.14% · P3

Affected Version Matrix 14

VendorProduct Version RangeStatus
Linux Linux 753f1ca4e1e50248a1b760c9774d6d6b354562cc< 3c6cc9f2ca65b6dd61b1af75452dc0e1cd0aad8d affected
753f1ca4e1e50248a1b760c9774d6d6b354562cc< 1f9c828556416fbe3f49386708ce999fc4d4da06 affected
753f1ca4e1e50248a1b760c9774d6d6b354562cc< 479084ae0e1d9cb7929cb4298d35623de189f80a affected
753f1ca4e1e50248a1b760c9774d6d6b354562cc< e334cbf3388fd9334503a778a82d9e9f14dd2f71 affected
753f1ca4e1e50248a1b760c9774d6d6b354562cc< 44bea2032af0425e4ce6d26a8af0ede79db49ec1 affected
753f1ca4e1e50248a1b760c9774d6d6b354562cc< 4db79a322db8c97f7b73b8a347395ef4d685eb40 affected
6.0 affected
< 6.0 unaffected
… +6 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-46323

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
net: gro: don't merge zcopy skbs
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: net: gro: don't merge zcopy skbs skb_gro_receive() can currently copy frags between the source and GRO skb, without checking the zerocopy status, and in particular the SKBFL_MANAGED_FRAG_REFS flag. When SKBFL_MANAGED_FRAG_REFS is set, the skb doesn't hold a reference on the pages in shinfo->frags. Appending those frags to another skb's frags without fixing up the page refcount can lead to UAF. When either the last skb in the GRO chain (the one we would append frags to) or the source skb is zerocopy, don't merge the skbs.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于skb_gro_receive()函数在复制frags时未检查零拷贝状态，可能导致释放后重用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 753f1ca4e1e50248a1b760c9774d6d6b354562cc ~ 3c6cc9f2ca65b6dd61b1af75452dc0e1cd0aad8d -
Linux Linux 6.0 -

II. Public POCs for CVE-2026-46323

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-46323

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-46323 (5)

Same Patch Batch · Linux · 2026-06-09 · 21 CVEs total

CVE-2026-46325 9.8 CRITICAL RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE
CVE-2026-46316 9.3 CRITICAL KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry
CVE-2026-46317 8.8 HIGH KVM: arm64: Reassign nested_mmus array behind mmu_lock
CVE-2026-46326 8.4 HIGH iio: pressure: mprls0025pa: fix spi_transfer struct initialisation
CVE-2026-46332 8.0 HIGH greybus: gb-beagleplay: bound bootloader receive buffering
CVE-2026-52907 7.8 HIGH media: rockchip: rkcif: fix off by one bugs
CVE-2026-46319 7.8 HIGH net/sched: act_ct: Only release RCU read lock after ct_ft
CVE-2026-46330 7.8 HIGH Revert "net/smc: Introduce TCP ULP support"
CVE-2026-46324 7.8 HIGH netfilter: nf_tables: use list_del_rcu for netlink hooks
CVE-2026-46327 7.8 HIGH dm: fix unlocked test for dm_suspended_md
CVE-2026-52906 7.7 HIGH 9p: fix access mode flags being ORed instead of replaced
CVE-2026-46320 7.4 HIGH tap: free page on error paths in tap_get_user_xdp()
CVE-2026-46328 7.3 HIGH apparmor: fix rlimit for posix cpu timers
CVE-2026-46322 7.1 HIGH tun: free page on build_skb failure in tun_xdp_one()
CVE-2026-46321 7.1 HIGH tun: free page on short-frame rejection in tun_xdp_one()
CVE-2026-46329 erofs: handle end of filesystem properly for file-backed mounts
CVE-2026-46318 Revert "mm/hugetlbfs: update hugetlbfs to use mmap_prepare"
CVE-2026-52904 drm/nouveau: fix nvkm_device leak on aperture removal failure
CVE-2026-52905 mm/damon/core: disallow non-power of two min_region_sz on damon_start()
CVE-2026-46315 io_uring/waitid: clear waitid info before copying it to userspace

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-46323

No comments yet

Leave a comment