ACK: [SRU][N:hwe-6.17/N:hwe-6.17][PATCH 0/2] CVE-2026-46331

[Alessio Faina]

On Wed, Jul 22, 2026 at 08:02:32PM +0300, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-46331
> 
> [ Impact ]
> 
> tcf_pedit_act() computed the copy-on-write range once before the key loop
> using tcfp_off_max_hint, which does not account for the runtime header
> offset added by typed keys. Part of the write region could be left
> un-COW'd, letting a crafted pedit action corrupt shared page cache pages.
> Configuring tc pedit actions requires CAP_NET_ADMIN in the relevant network
> namespace.
> 
> [ Fix ]
> 
> noble/linux-hwe-6.17: clean cherry-pick
> 
> [ Test Plan ]
> 
> Build tested only (CBD).
> 
> [ Where Problems Could Occur ]
> 
> The change is confined to net/sched/act_pedit.c and its header, moving the
> COW inside the per-key loop and adding offset overflow checks. An error
> could break legitimate pedit rules or headroom handling, but this matches
> the upstream commit exactly.
> 
> -- 
> kernel-team mailing list
> kernel-team at lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team

In the subject N:hwe-6.17 is mentioned 2 times.

Acked-by: Alessio Faina <alessio.faina at canonical.com>