In the Linux kernel, the following vulnerability has been resolved: net: gro: don't merge zcopy skbs skb_gro_receive() can currently copy frags… (CVE-2026-46323)
In the Linux kernel, the following vulnerability has been resolved: net: gro: don't merge zcopy skbs skb_gro_receive() can currently copy frags between the source and GRO skb, without checking the zerocopy status, and in particular the SKBFL_MANAGED_FRAG_REFS flag. When SKBFL_MANAGED_FRAG_REFS is set, the skb doesn't hold a reference on the pages in shinfo->frags. Appending those frags to another skb's frags without fixing up the page refcount can lead to UAF. When either the last skb in the GRO chain (the one we would append frags to) or the source skb is zerocopy, don't merge the skbs.
AI Analysis
Technical Summary
CVE-2026-46323 is a use-after-free vulnerability in the Linux kernel's net/gro component caused by improper handling of zerocopy socket buffers (skbs). This flaw can lead to memory corruption, potentially allowing attackers with local privileges to cause denial of service or escalate privileges. The vulnerability affects Red Hat Enterprise Linux 10 and associated variants. Red Hat has issued a security advisory and released updated kernel packages that fix this issue. The update requires a system reboot to activate the patch.
Potential Impact
The vulnerability has a high impact on confidentiality, integrity, and availability as indicated by the CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation could allow a local attacker with low privileges to execute arbitrary code or cause system crashes due to use-after-free memory corruption in the kernel networking subsystem. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
Red Hat has released an official security update for the Linux kernel in Red Hat Enterprise Linux 10 that addresses CVE-2026-46323. Users should apply the updated kernel packages provided by Red Hat and reboot their systems to ensure the patch is active. For detailed update instructions, refer to Red Hat's advisory and article at https://access.redhat.com/articles/11258. No additional mitigation actions are indicated by the vendor.
In the Linux kernel, the following vulnerability has been resolved: net: gro: don't merge zcopy skbs skb_gro_receive() can currently copy frags… (CVE-2026-46323)
Description
In the Linux kernel, the following vulnerability has been resolved: net: gro: don't merge zcopy skbs skb_gro_receive() can currently copy frags between the source and GRO skb, without checking the zerocopy status, and in particular the SKBFL_MANAGED_FRAG_REFS flag. When SKBFL_MANAGED_FRAG_REFS is set, the skb doesn't hold a reference on the pages in shinfo->frags. Appending those frags to another skb's frags without fixing up the page refcount can lead to UAF. When either the last skb in the GRO chain (the one we would append frags to) or the source skb is zerocopy, don't merge the skbs.
CVSS v3.1
Score 7.8high
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-46323 is a use-after-free vulnerability in the Linux kernel's net/gro component caused by improper handling of zerocopy socket buffers (skbs). This flaw can lead to memory corruption, potentially allowing attackers with local privileges to cause denial of service or escalate privileges. The vulnerability affects Red Hat Enterprise Linux 10 and associated variants. Red Hat has issued a security advisory and released updated kernel packages that fix this issue. The update requires a system reboot to activate the patch.
Potential Impact
The vulnerability has a high impact on confidentiality, integrity, and availability as indicated by the CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation could allow a local attacker with low privileges to execute arbitrary code or cause system crashes due to use-after-free memory corruption in the kernel networking subsystem. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
Red Hat has released an official security update for the Linux kernel in Red Hat Enterprise Linux 10 that addresses CVE-2026-46323. Users should apply the updated kernel packages provided by Red Hat and reboot their systems to ensure the patch is active. For detailed update instructions, refer to Red Hat's advisory and article at https://access.redhat.com/articles/11258. No additional mitigation actions are indicated by the vendor.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_vex
- Csaf Version
- 2.0
- Publisher
- Microsoft Security Response Center
- Advisory Id
- msrc_CVE-2026-46323
- Cve Count
- 1
- Additional Cves
- []
- Cvss Version
- 3.1
Threat ID: 6a294d9c8dd33fbd853b00d3
Added to database: 06/10/2026, 11:42:20 UTC
Last enriched: 07/30/2026, 15:21:45 UTC
Last updated: 07/31/2026, 19:24:47 UTC
Views: 97
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.