CVE-2026-46323

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The skb gro receive() function fails to check the zerocopy status, specifically the SKBFL MANAGED FRAG REFS flag, when copying fragments between the source and Generic Receive Offload (GRO) socket buffers (skbs). When SKBFL MANAGED FRAG REFS is set, the skb does not hold a reference to the pages in shinfo->frags. Appending these fragments to another skb without adjusting the page reference count can result in a Use-After-Free (UAF) condition, which occurs when a program continues to use a pointer after it has been freed. This issue occurs when either the source skb or the last skb in the GRO chain is zerocopy.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.