A vulnerability in the Linux kernel, identified as CVE-2026-46331, has been exploited in the wild approximately 71 days after its public disclosure. The flaw, which received a CVSS score of 7.8 (High severity), involves a partial copy-on-write (COW) issue in the `net/sched` component, specifically within the `tcf_pedit_act()` function.
The vulnerability stems from `tcf_pedit_act()` calculating the COW range for `skb_ensure_writable()` before the key loop, using `tcfp_off_max_hint`. This hint, however, does not account for the runtime header offset introduced by typed keys, potentially leaving a portion of the write region un-COWed. The fix involves relocating `skb_ensure_writable()` inside the per-key loop, where the actual write offset is known, and incorporating overflow checks for offset arithmetic. For negative offsets, such as those for Ethernet header edits at ingress, `skb_cow()` is used to manage the headroom. Additionally, `offset_valid()` is now guarded against `INT_MIN` to prevent negation issues.
CVE-2026-46331 was initially published on June 16, 2026. Evidence of its exploitation first appeared on August 26, 2026, marking a 71-day window between disclosure and confirmed exploitation. While the vulnerability is listed as exploited in the VulnCheck KEV (Known Exploited Vulnerabilities) catalog, it has not been added to the CISA KEV by the U.S. federal government or the EUVD by ENISA (European Union Agency for Cybersecurity). The CIRCL aggregator mirrors the VulnCheck listing but is not considered an independent corroborating source.
The exploitation of this vulnerability was reported by Securelist on August 26, 2026. The weakness is categorized under CWE-190 (Integer Overflow or Wraparound). The EPSS (Exploit Prediction Scoring System) score for CVE-2026-46331 is 0.58%, placing it in the 46.6th percentile, indicating a moderate likelihood of exploitation.
