An update for kernel is now available for openEuler-20.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-2870 Final 1.0 1.0 2026-07-06 Initial 2026-07-06 2026-07-06 openEuler SA Tool V1.0 2026-07-06 kernel security update An update for kernel is now available for openEuler-20.03-LTS-SP4 The Linux Kernel, the operating system core itself. Security Fix(es): In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.(CVE-2026-46331) An update for kernel is now available for openEuler-20.03-LTS-SP4/openEuler-22.03-LTS-SP3/openEuler-24.03-LTS/openEuler-24.03-LTS-SP2. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High kernel https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2870 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-46331 https://nvd.nist.gov/vuln/detail/CVE-2026-46331 openEuler-20.03-LTS-SP4 bpftool-4.19.90-2606.5.0.0378.oe2003sp4.aarch64.rpm bpftool-debuginfo-4.19.90-2606.5.0.0378.oe2003sp4.aarch64.rpm kernel-4.19.90-2606.5.0.0378.oe2003sp4.aarch64.rpm kernel-debuginfo-4.19.90-2606.5.0.0378.oe2003sp4.aarch64.rpm kernel-debugsource-4.19.90-2606.5.0.0378.oe2003sp4.aarch64.rpm kernel-devel-4.19.90-2606.5.0.0378.oe2003sp4.aarch64.rpm kernel-source-4.19.90-2606.5.0.0378.oe2003sp4.aarch64.rpm kernel-tools-4.19.90-2606.5.0.0378.oe2003sp4.aarch64.rpm kernel-tools-debuginfo-4.19.90-2606.5.0.0378.oe2003sp4.aarch64.rpm kernel-tools-devel-4.19.90-2606.5.0.0378.oe2003sp4.aarch64.rpm perf-4.19.90-2606.5.0.0378.oe2003sp4.aarch64.rpm perf-debuginfo-4.19.90-2606.5.0.0378.oe2003sp4.aarch64.rpm python2-perf-4.19.90-2606.5.0.0378.oe2003sp4.aarch64.rpm python2-perf-debuginfo-4.19.90-2606.5.0.0378.oe2003sp4.aarch64.rpm python3-perf-4.19.90-2606.5.0.0378.oe2003sp4.aarch64.rpm python3-perf-debuginfo-4.19.90-2606.5.0.0378.oe2003sp4.aarch64.rpm bpftool-4.19.90-2606.5.0.0378.oe2003sp4.x86_64.rpm bpftool-debuginfo-4.19.90-2606.5.0.0378.oe2003sp4.x86_64.rpm kernel-4.19.90-2606.5.0.0378.oe2003sp4.x86_64.rpm kernel-debuginfo-4.19.90-2606.5.0.0378.oe2003sp4.x86_64.rpm kernel-debugsource-4.19.90-2606.5.0.0378.oe2003sp4.x86_64.rpm kernel-devel-4.19.90-2606.5.0.0378.oe2003sp4.x86_64.rpm kernel-source-4.19.90-2606.5.0.0378.oe2003sp4.x86_64.rpm kernel-tools-4.19.90-2606.5.0.0378.oe2003sp4.x86_64.rpm kernel-tools-debuginfo-4.19.90-2606.5.0.0378.oe2003sp4.x86_64.rpm kernel-tools-devel-4.19.90-2606.5.0.0378.oe2003sp4.x86_64.rpm perf-4.19.90-2606.5.0.0378.oe2003sp4.x86_64.rpm perf-debuginfo-4.19.90-2606.5.0.0378.oe2003sp4.x86_64.rpm python2-perf-4.19.90-2606.5.0.0378.oe2003sp4.x86_64.rpm python2-perf-debuginfo-4.19.90-2606.5.0.0378.oe2003sp4.x86_64.rpm python3-perf-4.19.90-2606.5.0.0378.oe2003sp4.x86_64.rpm python3-perf-debuginfo-4.19.90-2606.5.0.0378.oe2003sp4.x86_64.rpm kernel-4.19.90-2606.5.0.0378.oe2003sp4.src.rpm In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined. 2026-07-06 CVE-2026-46331 openEuler-20.03-LTS-SP4 High 7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H kernel security update 2026-07-06 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2870