CVE-2026-46323: Linux Kernel GRO Use-After-Free in Zerocopy Packet Handling

Technical summary

CVE-2026-46323 exists in skb_gro_receive(), which merges incoming network packets into larger batches for performance. The function copies fragment pointers between socket buffers without validating the SKBFL_MANAGED_FRAG_REFS flag, which indicates whether the kernel or a user-space zerocopy provider owns page reference counting. When this flag is set, the source skb holds no reference to its pages—they are managed externally. Merging such fragments into a destination skb without updating refcounts creates a window where the external provider can release pages while the kernel still references them, triggering a use-after-free. The fix prevents GRO merging whenever either the source or destination skb is flagged as zerocopy.

Business impact

The vulnerability poses a moderate but real risk to production Linux systems handling high-speed network traffic with zerocopy optimizations enabled (common in telecommunications, financial networks, and high-performance computing). Successful exploitation by a local, network-capable process can crash the kernel or potentially execute arbitrary code in kernel context. Services relying on kernel stability—such as cloud platforms, network appliances, and containerized workloads—may experience unexpected downtime or security breaches if exploited.

Affected systems

All versions of the Linux kernel prior to the patch are affected. The vulnerability is most relevant to systems explicitly using zerocopy socket APIs (MSG_ZEROCOPY, AF_PACKET with PACKET_MMAP, or similar mechanisms) and running GRO-enabled network drivers, which includes virtually all modern Linux distributions in standard configurations.

Exploitability

Exploitation requires local access and the ability to send or receive network traffic with zerocopy enabled—a capability available to unprivileged processes that open sockets. The attack surface is restricted to systems where GRO is active on zerocopy-capable network paths, but the actual trigger is reliable once those conditions are met. The vulnerability is not known to be exploited in the wild as of publication, and no public proof-of-concept code is available.

Remediation

Apply kernel patches that add a check preventing GRO merging when either the source or destination skb has the SKBFL_MANAGED_FRAG_REFS flag set. This is a targeted, low-risk fix that preserves GRO performance for non-zerocopy traffic. Verify patches against the official Linux kernel security advisories and your distribution's kernel branch.

Patch guidance

Identify your kernel version using `uname -r`. Check your Linux distribution's security updates for patched kernel versions addressing CVE-2026-46323. For distributions tracking the upstream kernel, verify the commit that disables GRO merging for zerocopy skbs is included. Test the patched kernel in a staging environment to ensure network performance and stability before production rollout. Reboot systems to apply the update.

Detection guidance

Monitor for unexpected kernel panics or warnings in kernel logs (`journalctl -k`, `dmesg`) mentioning skb_gro_receive() or use-after-free conditions, which may indicate exploitation attempts. Network monitoring tools analyzing GRO statistics may show anomalies if the vulnerability is triggered. System call tracing (`strace`, BPF-based monitoring) targeting socket creation and MSG_ZEROCOPY usage can help identify risky processes, though post-exploitation detection is inherently difficult with UAF bugs.

Why prioritize this

This is a HIGH-severity local privilege escalation vector affecting kernel stability. While exploitation requires local access and specific zerocopy configuration, the scope is local (SU) and impact is severe (C:H, I:H, A:H). Organizations running high-performance networking stacks or cloud/container platforms should prioritize patching. Systems not using zerocopy APIs have lower immediate risk but should still patch as part of standard kernel maintenance.

Risk score, explained

CVSS 3.1 score of 7.8 (HIGH) reflects: local attack vector, low complexity (reliable trigger once conditions align), low privileges required (unprivileged socket access suffices), no user interaction, local scope, and high impact across confidentiality, integrity, and availability. The score appropriately captures a serious kernel vulnerability with moderate exploitability friction rather than a critical remote issue.

Frequently asked questions