New Linux pedit COW Exploit Enables Root Access by Poisoning Cached Binaries

1. Executive summary

CVE-2026-46331 ("pedit COW") is an out-of-bounds write vulnerability in the Linux kernel's traffic-control packet-editing action (act_pedit) that enables a local unprivileged user to gain root by corrupting shared page-cache memory. A public, working proof-of-concept exploit appeared within a day of CVE assignment on 16 June 2026. The exploit poisons the cached in-memory copy of a setuid root binary (e.g. /bin/su) without touching the file on disk, meaning file-integrity monitoring returns clean results while a root shell is active. EMEA financial services running affected Linux kernels — particularly multi-tenant hosts, CI/CD runners, Kubernetes nodes, and build workers — face local privilege-escalation risk from any user with a shell on the system.

2. Regulatory framing

No specific UK NIS 2018 article trigger is directly engaged by this item unless the affected host constitutes an OES/RDSP-covered system.

3. Technical analysis & attack chain

Confirmed attack chain (multi-source corroborated via The Hacker News reporting)

1. Initial access: Attacker has an unprivileged local shell on a vulnerable Linux host. No network access or remote exploitation is required.
2. Capability acquisition: Attacker creates a user namespace, which grants namespace-local CAP_NET_ADMIN — the capability needed to configure tc actions. This requires unprivileged user namespaces to be permitted on the host.
3. Trigger: Attacker configures a tc traffic-control rule using the pedit action with edit keys whose offsets resolve at runtime.
4. Vulnerability mechanism: The kernel function tcf_pedit_act() is supposed to make a private copy-on-write copy of packet data before editing. It performs a single bounds check before the final offsets are known. When certain edit keys resolve their offset at runtime, the write lands outside the privately copied region and the kernel writes into a shared page-cache page instead.
5. Page-cache corruption: If the shared page belongs to a cached file (e.g. /bin/su, a setuid root binary), the file's in-memory image is corrupted with attacker-controlled data. The on-disk file is never modified.
6. Payload execution: The attacker injects a small payload into the cached copy of the setuid binary and executes it. The altered image runs as root, yielding a root shell.
7. Evasion: File-integrity monitoring (FIM) checks return clean because the on-disk file is unmodified. The corruption exists only in the kernel page cache.

Affected systems (per source reporting)

• RHEL 10 and Debian 13 (trixie): Confirmed unprivileged-to-root exploitation. Unprivileged user namespaces are open by default.
• Ubuntu 24.04: Exploitable but requires routing execution through AppArmor profiles that still permit user namespaces.
• Ubuntu 26.04: Underlying kernel remains vulnerable, but the exploit path is blocked by default because AppArmor profiles restrict unprivileged user namespaces.
• RHEL 8, 9, 10: Listed as affected by Red Hat. RHEL 7 is not listed in the bulletin.
• Debian 11 and 12: Listed as vulnerable. Debian has fixed trixie through its security channel.
• Ubuntu 18.04 through 26.04: Listed as vulnerable as of 25 June.

Prerequisites for exploitation

• act_pedit kernel module must be loadable.
• Unprivileged user namespaces must be permitted (user.max_user_namespaces > 0 on RHEL; kernel.unprivileged_userns_clone=1 on Debian/Ubuntu).

Context — related vulnerability family: The source draws a lineage to Dirty Pipe, Copy Fail, DirtyClone, and Dirty Frag — all sharing the pattern of a kernel fast path writing into a page it does not exclusively own. CVE-2026-43503 ("DirtyClone", CVSS 8.8) is a related variant with a public exploit walkthrough published by JFrog Security Research on 25 June. CVE-2026-43503 is a distinct vulnerability with its own CVE and CVSS score; do not conflate it with CVE-2026-46331.

Confidence caveat: All technical detail in this advisory is single-sourced, drawn from The Hacker News reporting. No independent vendor advisory, NVD entry, or second-source corroboration was available at time of writing. The CVSS score for CVE-2026-46331 is unknown in the verified reference data; the source quotes Red Hat rating the flaw as "important" but provides no numeric CVSS. EPSS is 0% and the CVE is not in CISA KEV. Verify before enforcement.

4. Mitigation & containment

P1 — Within 24 hours: Identify and isolate exposed hosts

• Inventory all Linux hosts and identify those matching affected versions (RHEL 8/9/10, Debian 11/12/13, Ubuntu 18.04–26.04).
• Priorise multi-tenant hosts, CI/CD runners, Kubernetes nodes, build workers, and shared research/lab machines — anywhere "local user" does not mean "trusted user."
• Check whether act_pedit is loaded: lsmod | grep act_pedit
• Check whether unprivileged user namespaces are enabled:
• RHEL: cat /proc/sys/user/max_user_namespaces (value > 0 means enabled)
• Debian/Ubuntu: cat /proc/sys/kernel/unprivileged_userns_clone (value 1 means enabled)

P2 — Within 72 hours: Apply mitigations on hosts that cannot be patched immediately

• Option A — Block the act_pedit module (preferred; least disruptive on systems not using tc pedit rules): bash echo 'install act_pedit /bin/true' | sudo tee /etc/modprobe.d/disable-act_pedit.conf If the module is already loaded, also unload it: sudo rmmod act_pedit (only if not in use).
• Option B — Disable unprivileged user namespaces (removes the namespace-local CAP_NET_ADMIN the exploit needs):
• RHEL: echo 0 | sudo tee /proc/sys/user/max_user_namespaces
• Debian/Ubuntu: echo 0 | sudo tee /proc/sys/kernel/unprivileged_userns_clone
• Make persistent: add the appropriate line to /etc/sysctl.d/ (e.g. /etc/sysctl.d/99-disable-userns.conf).
• Warning: This breaks rootless containers, some CI sandboxes, and sandboxed browsers. Test first.

P3 — Within 7 days: Patch and reboot

• Install the patched kernel from your vendor's security channel and reboot.
• Debian: fixed trixie available via security channel. Check Debian 11/12 for pending fixes.
• Ubuntu: check security updates for supported releases 18.04–26.04.
• Red Hat: check errata for RHEL 8, 9, 10.

Post-incident note: If exploitation is suspected or confirmed, dropping the page cache (echo 3 > /proc/sys/vm/drop_caches) clears the poisoned in-memory copy but does not remediate an already-open root shell. Treat the host as compromised and rebuild from known-good state.

5. Indicators of compromise

No indicators of compromise available in the source material. The exploit operates entirely in memory; no file artefacts, network indicators, mutex names, or command-line fingerprints were specified in the source. The source notes that file-integrity checks return clean by design.

6. Detection

Behavioural detection — Sigma rule

The source provides specific behavioural indicators: tc command usage with pedit action by unprivileged users, and the act_pedit module loading. The following Sigma rule targets the process-execution signature of the exploit chain.

title: Linux pedit COW Expit — tc pedit Action Configuration
id: at-2026-06-26-187-sigma-1
status: experimental
description: Detects tc pedit action configuration, which may indicate exploitation of CVE-2026-46331 (pedit COW) for local privilege escalation
references:

  - https://thehackernews.com/2026/06/new-linux-pedit-cow-exploit-enables.html
author: Adverse Trace
date: 2026/06/26
logsource:
  product: linux
detection:
  selection:
    CommandLine|contains:

      - "tc "
      - "pedit"
  condition: selection
falsepositives:

  - Legitimate traffic-control configuration by network administrators
  - Automated network provisioning tools
level: medium

YARA rule

The source does not provide file-based artefacts (no malware payload, no dropped files, no hardcoded strings). The exploit injects a "small payload" into page-cache memory but no payload content, hashes, or strings are specified. Insufficient indicators to author a meaningful YARA rule from the provided sources.

CVE assessment

1 referenced CVE

7. Sources

• The Hacker News — "New Linux pedit COW Exploit Enables Root Access by Poisoning Cached Binaries" — https://thehackernews.com/2026/06/new-linux-pedit-cow-exploit-enables.html — 2026-06-26
• The Hacker News — "New DirtyClone Linux Kernel Flaw Lets Local Users Gain Root via Cloned Packets" — https://thehackernews.com/2026/06/new-dirtyclone-linux-kernel-flaw-lets.html — 2026-06-25 (context on related CVE-2026-43503)

8. Adverse Trace position

CVE-2026-46331 presents a credible local privilege-escalation risk to EMEA financial services, particularly for institutions operating multi-tenant Linux infrastructure, CI/CD pipelines, or Kubernetes clusters where unprivileged users have shell access. The CVSS score is unknown in verified reference data, EPSS is 0%, and the CVE is not in CISA KEV — we do not inflate these metrics. All technical detail is single-sourced via The Hacker News; attribution to any named threat actor is unconfirmed and no MITRE ATT&CK profile is referenced. The exploit's ability to evade file-integrity monitoring by corrupting only page-cache memory is the most operationally significant detail for defenders: FIM alone is insufficient. We recommend clients prioritise P1 host identification and P2 mitigation (blocking act_pedit module load) on exposed multi-tenant systems, then apply vendor kernel patches per P3. We will monitor for vendor advisories, NVD publication, and CISA KEV addition, and will issue an updated advisory if the CVSS score is confirmed or if exploitation is observed in the wild.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.