CVE-2026-46323

Name	CVE-2026-46323
Description	In the Linux kernel, the following vulnerability has been resolved: net: gro: don't merge zcopy skbs skb_gro_receive() can currently copy frags between the source and GRO skb, without checking the zerocopy status, and in particular the SKBFL_MANAGED_FRAG_REFS flag. When SKBFL_MANAGED_FRAG_REFS is set, the skb doesn't hold a reference on the pages in shinfo->frags. Appending those frags to another skb's frags without fixing up the page refcount can lead to UAF. When either the last skb in the GRO chain (the one we would append frags to) or the source skb is zerocopy, don't merge the skbs.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-6355-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
linux (PTS)	bullseye	5.10.223-1	fixed
	bullseye (security)	5.10.257-1	fixed
	bookworm	6.1.170-3	vulnerable
	bookworm (security)	6.1.174-1	vulnerable
	trixie	6.12.86-1	vulnerable
	trixie (security)	6.12.94-1	fixed
	forky, sid	7.0.13-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
linux	source	bullseye	(not affected)
linux	source	trixie	6.12.94-1	DSA-6355-1
linux	source	(unstable)	7.0.12-1

[bullseye] - linux <not-affected> (Vulnerable code not present)
https://git.kernel.org/linus/4db79a322db8c97f7b73b8a347395ef4d685eb40 (7.1-rc5)