APPLIED: [SRU][N:hwe-6.17/N:hwe-6.17][PATCH 0/2] CVE-2026-46331

[Edoardo Canepa]

Applied to n:linux/hwe-6.17-master-next. Thanks.

On 7/22/26 19:02, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-46331
>
> [ Impact ]
>
> tcf_pedit_act() computed the copy-on-write range once before the key loop
> using tcfp_off_max_hint, which does not account for the runtime header
> offset added by typed keys. Part of the write region could be left
> un-COW'd, letting a crafted pedit action corrupt shared page cache pages.
> Configuring tc pedit actions requires CAP_NET_ADMIN in the relevant network
> namespace.
>
> [ Fix ]
>
> noble/linux-hwe-6.17: clean cherry-pick
>
> [ Test Plan ]
>
> Build tested only (CBD).
>
> [ Where Problems Could Occur ]
>
> The change is confined to net/sched/act_pedit.c and its header, moving the
> COW inside the per-key loop and adding offset overflow checks. An error
> could break legitimate pedit rules or headroom handling, but this matches
> the upstream commit exactly.
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0x20F88172E14F6784.asc
Type: application/pgp-keys
Size: 3167 bytes
Desc: OpenPGP public key
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260723/7cc48349/attachment.key>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260723/7cc48349/attachment.sig>