Skip to main content

Linux Kernel EUVDEUVD-2026-35413

| CVE-2026-46323 HIGH
Write-what-where Condition (CWE-123)
2026-06-09 Linux GHSA-hf4r-hm8m-w52j
Information Disclosure Linux
7.8
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Obtain local shell on Linux host
  2. Delivery
    Open zero-copy socket (MSG_ZEROCOPY/io_uring)
  3. Exploit
    Drive traffic into GRO receive path
  4. Install
    Trigger skb_gro_receive() frag merge with managed-refs skb
  5. C2
    Release zero-copy pages to dangle GRO frag pointers
  6. Execute
    Reclaim freed pages with attacker-controlled data
  7. Impact
    Escalate to kernel code execution

Vulnerability Assessment

Weakness
CWE
CWE-123
ASVS 5.0
V15 - Secure Coding and Architecture Write-what-where prevention
Exploitation Conditions

Local code execution on the target host is required (CVSS AV:L, PR:L) - there is no remote network-only path. The vulnerable code path is only reachable when GRO is enabled on the receive side (the default on virtually all modern NICs) AND an skb carrying SKBFL_MANAGED_FRAG_REFS reaches skb_gro_receive(), which in practice means the system must be using a zero-copy transmit mechanism such as MSG_ZEROCOPY or io_uring send-zc that produces managed-refs skbs landing in the GRO path. Kernels older than 6.0 are not affected because SKBFL_MANAGED_FRAG_REFS did not exist. No user interaction is required once the attacker has local execution, but practical exploitation also requires winning a race between the GRO merge and the zero-copy page release, which raises real-world complexity above the AC:L rating.
Impact

CVSS 3.1 of 7.8 with AV:L/AC:L/PR:L/UI:N reflects local, low-complexity, low-privileged kernel memory corruption with full CIA impact - consistent with a kernel UAF. However, EPSS is 0.02% (5th percentile), this CVE is NOT on CISA KEV, and no public PoC has been published, so real-world risk today is much lower than the base score suggests. The vulnerable code path requires a system actually using zero-copy senders alongside GRO receive on the same skb chain, which narrows realistic exploitation to specialized workloads (io_uring zero-copy, high-performance networking). Treat as a standard stable-kernel hardening item rather than an emergency patch; the bigger concern is supply-chain backporting since the bug has existed since 6.0 and touches a very hot networking path.
Exploit ScenarioDerived

A local attacker with an unprivileged shell on a Linux host opens a socket using MSG_ZEROCOPY (or io_uring send-zc) and arranges traffic patterns that drive both the zero-copy send path and GRO receive aggregation against itself or a co-located process. They induce skb_gro_receive() to merge frags from a managed-refs skb into a normal GRO chain, then trigger release of the original zero-copy pages so the GRO skb retains dangling frag pointers, which they reclaim via page reuse to corrupt kernel memory and pivot to privilege escalation. No public exploit is identified at time of analysis.
This Week Schedule remediation this week. Why: Active threat signals + CRITICAL/HIGH severity.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 14, 2026

Use-after-free in the Linux kernel's Generic Receive Offload (GRO) networking path allows local attackers to corrupt kernel memory and potentially achieve privilege escalation or denial of service. The flaw stems from skb_gro_receive() merging fragment lists between socket buffers without honoring the SKBFL_MANAGED_FRAG_REFS zero-copy flag, leaving page refcounts inconsistent. No public exploit identified at time of analysis, and EPSS exploitation probability is very low at 0.02% (5th percentile).

RemediationAI

Vendor-released patch: upgrade to Linux 6.6.142, 6.12.92, 7.0.11, or 7.1-rc5 (or later) which include the fix that makes skb_gro_receive() refuse to merge whenever the last GRO chain skb or the source skb has zero-copy frags. Direct stable commits are available at https://git.kernel.org/stable/c/1f9c828556416fbe3f49386708ce999fc4d4da06, https://git.kernel.org/stable/c/479084ae0e1d9cb7929cb4298d35623de189f80a, https://git.kernel.org/stable/c/e334cbf3388fd9334503a778a82d9e9f14dd2f71, https://git.kernel.org/stable/c/44bea2032af0425e4ce6d26a8af0ede79db49ec1, and https://git.kernel.org/stable/c/4db79a322db8c97f7b73b8a347395ef4d685eb40 for self-built kernels; distribution users should apply the vendor errata for their tracked stream. As a temporary compensating control on systems that cannot reboot immediately, disable GRO on the affected interfaces with 'ethtool -K <iface> gro off' - note this can reduce network throughput and increase CPU usage on high-traffic NICs, so measure before deploying broadly. Restricting local user access (no untrusted shell or container workloads on the host) also reduces practical exposure given the AV:L vector.

Affected VersionsENISA

Linux patch: 6.12.92
Linux patch: 7.1-rc5
Linux 753f1ca4e1e50248a1b760c9774d6d6b354562cc <1f9c828556416fbe3f49386708ce999fc4d4da06
Linux 753f1ca4e1e50248a1b760c9774d6d6b354562cc <e334cbf3388fd9334503a778a82d9e9f14dd2f71
Linux patch: 7.0.11
Linux 753f1ca4e1e50248a1b760c9774d6d6b354562cc <479084ae0e1d9cb7929cb4298d35623de189f80a
Linux 6.0
Linux patch: 6.6.142
Linux patch: 6.18.34
Linux 753f1ca4e1e50248a1b760c9774d6d6b354562cc <44bea2032af0425e4ce6d26a8af0ede79db49ec1
Linux 753f1ca4e1e50248a1b760c9774d6d6b354562cc <4db79a322db8c97f7b73b8a347395ef4d685eb40
Linux patch: 0

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The bug lives in the Linux kernel's GRO subsystem (net/core), which aggregates incoming network packets into larger skbs before they are passed up the stack to improve throughput. When an skb is marked with SKBFL_MANAGED_FRAG_REFS, its shinfo->frags pages are not held with a normal page reference - the lifetime is managed by the originating zero-copy mechanism (commonly MSG_ZEROCOPY / io_uring send-zc or AF_XDP-style paths). skb_gro_receive() copied frags between the source skb and the GRO skb without consulting that flag, so the receiving skb ended up with frag pointers it never refcounted, classic use-after-free territory once the original owner releases the pages. The CWE is not assigned, but this is a UAF (CWE-416) introduced by commit 753f1ca4e1e5 (the MANAGED_FRAG_REFS infrastructure landed in Linux 6.0) and fixed by refusing to merge whenever either side of the merge is zero-copy.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.0 HIGH

Local kernel UAF reachable only by a local user driving a zero-copy + GRO race, so AV:L/PR:L/UI:N with AC:H for the race; successful exploitation yields full kernel CIA impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 7.0 HIGH
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat 7.8 HIGH

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Jun 14, 2026 - 06:22 NVD
7.8 (HIGH)
Patch available
Jun 09, 2026 - 14:01 EUVD
CVE Published
Jun 09, 2026 - 12:11 cve.org
HIGH 7.8
CVE Published
Jun 09, 2026 - 12:11 nvd
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: gro: don't merge zcopy skbs

skb_gro_receive() can currently copy frags between the source and GRO skb, without checking the zerocopy status, and in particular the SKBFL_MANAGED_FRAG_REFS flag.

When SKBFL_MANAGED_FRAG_REFS is set, the skb doesn't hold a reference on the pages in shinfo->frags. Appending those frags to another skb's frags without fixing up the page refcount can lead to UAF.

When either the last skb in the GRO chain (the one we would append frags to) or the source skb is zerocopy, don't merge the skbs.

Executive ViewAI

Why It Matters

A use-after-free vulnerability in the Linux kernel's Generic Receive Offload (GRO) networking subsystem affects all systems running vulnerable kernel versions and allows local attackers to corrupt kernel memory, potentially enabling privilege escalation or denial of service. With a CVSS score of 7.8 and confirmed patch availability, organizations must prioritize kernel updates across servers and workstations to eliminate this direct path to root-level compromise. The absence of public exploit code and very low exploitation probability (0.02% EPSS) provide a narrow window to deploy remediation before threat actors develop working exploits.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Threat Intel
2
1 sources
Social Media
1
Sightings
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS CISA MSRC Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat Yes
Deciding rule
Active threat signals + CRITICAL/HIGH severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

49
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: +10
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Related Vulnerabilities in Linux Kernel Memory and Network Vulnerabilities

View all 20
CVE-2026-46316 CRITICAL
9.3
CVE-2026-46327 HIGH
7.8
CVE-2026-46330 HIGH
7.8
CVE-2026-46325 CRITICAL
9.8
CVE-2026-46320 HIGH
7.4
CVE-2026-46322 HIGH
7.1
CVE-2026-46332 HIGH
8.0
CVE-2026-46321 HIGH
7.1
CVE-2026-46328 HIGH
7.3
CVE-2026-52907 HIGH
7.8
CVE-2026-46317 HIGH
8.8
CVE-2026-46318 MEDIUM
5.5
CVE-2026-46319 HIGH
7.8
CVE-2026-46324 HIGH
7.8
CVE-2026-46326 HIGH
8.4
CVE-2026-46329 MEDIUM
5.5
CVE-2026-52904 MEDIUM
5.5
CVE-2026-52905 MEDIUM
5.5
CVE-2026-52906 HIGH
7.7

Same weakness CWE-123 – Write-what-where Condition

View all
CVE-2026-46300 HIGH POC
7.8
CVE-2024-42479 CRITICAL POC
10.0
CVE-2015-8271 CRITICAL POC
9.8
CVE-2022-38143 CRITICAL POC
9.8
CVE-2026-94142 HIGH POC
8.5
CVE-2022-35408 HIGH POC
8.2
CVE-2022-40262 HIGH POC
8.2
CVE-2024-2607 HIGH POC
8.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected

Threat IntelligenceMISP

CISA Advisories
ICSA-26-295-11 ICSA-26-295-16
Sources: Microsoft MSRC, CISA (public domain)

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-46323 ADVISORY https://ubuntu.com/security/notices/USN-8440-1 ADVISORY https://vuldb.com/vuln/369523 REF https://access.redhat.com/errata/RHSA-2026:27708 REF https://access.redhat.com/errata/RHSA-2026:27731 REF https://access.redhat.com/errata/RHSA-2026:27735 REF https://access.redhat.com/errata/RHSA-2026:36018 REF https://access.redhat.com/errata/RHSA-2026:44230 REF https://access.redhat.com/errata/RHSA-2026:44231 REF https://access.redhat.com/errata/RHSA-2026:44259 REF https://access.redhat.com/errata/RHSA-2026:44262 REF https://access.redhat.com/errata/RHSA-2026:44270 REF https://access.redhat.com/errata/RHSA-2026:47727 REF https://access.redhat.com/errata/RHSA-2026:62639 REF https://access.redhat.com/errata/RHSA-2026:62640 REF https://access.redhat.com/errata/RHSA-2026:62641 REF https://access.redhat.com/errata/RHSA-2026:62642 REF https://access.redhat.com/security/cve/CVE-2026-46323 REF https://bugzilla.redhat.com/show_bug.cgi?id=2479832 REF https://cert-portal.siemens.com/productcert/html/ssa-019113.html REF https://cert-portal.siemens.com/productcert/html/ssa-457936.html REF https://cert-portal.siemens.com/productcert/html/ssa-784472.html REF https://git.kernel.org/stable/c/1f9c828556416fbe3f49386708ce999fc4d4da06 REF https://git.kernel.org/stable/c/3c6cc9f2ca65b6dd61b1af75452dc0e1cd0aad8d REF https://git.kernel.org/stable/c/44bea2032af0425e4ce6d26a8af0ede79db49ec1 REF https://git.kernel.org/stable/c/479084ae0e1d9cb7929cb4298d35623de189f80a REF https://git.kernel.org/stable/c/4db79a322db8c97f7b73b8a347395ef4d685eb40 REF https://git.kernel.org/stable/c/e334cbf3388fd9334503a778a82d9e9f14dd2f71 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46323.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy