CVE-2026-46323: net: gro: don't merge zcopy skbs

Synopsis

A use-after-free (UAF) vulnerability exists in the Linux kernel's Generic Receive Offload (GRO) networking subsystem. The flaw is reachable locally by any low-privilege user and arises because skb_gro_receive() can append page fragments from a zerocopy socket buffer to another buffer without correctly adjusting reference counts, leaving freed memory accessible. Successful exploitation gives an attacker full read, write, and crash capability over the kernel, enabling privilege escalation or complete system compromise. Patched-image rebuilds at the fix commits are available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the target is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient to trigger the vulnerable code path; no administrative rights are needed.

• Victim interactionNot required

  No user interaction or social engineering is required; the attacker exploits the kernel directly.

• Attack complexityDetail

  The exploit is reliable and condition-free once local access is established; no race conditions or specific memory layout requirements are imposed.

Blast Radius

• Reads arbitrary kernel memory, exposing credentials, cryptographic keys, and sensitive process data.
• Writes to arbitrary kernel memory, allowing privilege escalation to root or modification of security-relevant kernel state.
• Crashes the affected kernel, causing a full system outage and denial of service for all workloads on the host.
• Container isolation boundaries can be broken, potentially exposing data and processes across co-located workloads on the same node.