Linux pedit COW Flaw (CVE-2026-46331) Enables Root via Cached Binary Poisoning
A serious flaw in the Linux kernel's traffic-control subsystem, tracked as CVE-2026-46331 and nicknamed "pedit COW," allows a local unprivileged user to escalate to root on vulnerable systems. The bug is an out-of-bounds write inside the packet-editing action (act_pedit) that corrupts shared page-cache memory, and a working public exploit surfaced within a day of the CVE assignment on June 16. Red Hat has rated the flaw as Important, and defenders should treat multi-tenant hosts, CI runners, and Kubernetes nodes as priority targets for patching.
Technically, the vulnerability lives in the tcf_pedit_act() kernel function used by the tc traffic-control tool to rewrite packet headers in flight. The code is supposed to follow the standard copy-on-write pattern, but it validates the writable range once before final offsets are resolved. When certain edit keys defer offset resolution to runtime, the subsequent write lands outside the privately copied region and instead modifies a shared page-cache page. If that page belongs to a cached setuid root binary such as /bin/su, the in-memory image is silently corrupted. The exploit then injects a small payload, executes the altered image as root, and leaves the on-disk file untouched, which means file-integrity checks report the system as clean while a root shell is already open. The pattern echoes Dirty Pipe, Copy Fail, DirtyClone, and Dirty Frag, but the entry point is new: an unprivileged user can configure tc actions from inside a user namespace, gaining the namespace-local CAP_NET_ADMIN needed to trigger the bug. Administrators can audit exposure with a port scanner to confirm which services are reachable while a patch is staged.
The exploitation prerequisites are two conditions that are commonly met in production: the act_pedit action must be loadable, and unprivileged user namespaces must be open. On the PoC author's test systems, RHEL 10 and Debian 13 (trixie) shipped both enabled by default, giving a straightforward unprivileged-to-root path. Ubuntu 24.04 needed a detour through AppArmor profiles that still permit user namespaces, while Ubuntu 26.04 blocks that route by default even though the underlying kernel remains vulnerable. Vendor responses are uneven: Debian has patched trixie through its security channel, but Debian 11 and 12 are still listed as vulnerable; Ubuntu flags supported releases from 18.04 through 26.04 as affected as of June 25; and Red Hat lists RHEL 8, 9, and 10 as impacted, with RHEL 7 absent from the bulletin. Verify your distribution's package metadata via WHOIS lookup on vendor advisories to confirm which kernel builds carry the fix.
The immediate remediation is to install the patched kernel and reboot, prioritizing systems where a local user should not be considered trusted. Where patching must wait, two mitigations break the exploit chain: disable the act_pedit tc action (or unload the kernel modules that expose it) and restrict unprivileged user namespaces through sysctl or AppArmor policies. After patching, harden the broader attack surface by validating TLS posture on exposed services with an SSL/TLS checker and reviewing local user accounts for any signs of compromise that may have occurred during the window of exposure.