[SRU][N:hwe-6.17/N:hwe-6.17][PATCH 0/2] CVE-2026-46331

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-46331

[ Impact ]

tcf_pedit_act() computed the copy-on-write range once before the key loop
using tcfp_off_max_hint, which does not account for the runtime header
offset added by typed keys. Part of the write region could be left
un-COW'd, letting a crafted pedit action corrupt shared page cache pages.
Configuring tc pedit actions requires CAP_NET_ADMIN in the relevant network
namespace.

[ Fix ]

noble/linux-hwe-6.17: clean cherry-pick

[ Test Plan ]

Build tested only (CBD).

[ Where Problems Could Occur ]

The change is confined to net/sched/act_pedit.c and its header, moving the
COW inside the per-key loop and adding offset overflow checks. An error
could break legitimate pedit rules or headroom handling, but this matches
the upstream commit exactly.