Linux Kernel act_pedit Partial Copy-on-Write Page-Cache Corruption Local Privilege Escalation (CVE-2026-46331, "pedit COW")

Linux Kernel act_pedit Partial Copy-on-Write Page-Cache (TL-2026-0951), also tracked as pedit COW, is a high-severity software vulnerability, first published 2026-06-26. It has no confirmed attribution, affects Linux Linux Kernel (net/sched act_pedit), references 1 CVE (CVE-2026-46331), maps to 16 MITRE ATT&CK techniques (T1059, T1068, T1070), and is covered by 9 detection rules and 16 indicators of compromise.

Key facts for TL-2026-0951

Threat ID
TL-2026-0951
Also known as
pedit COW, packet_edit_meme
Severity
HIGH
Status
ACTIVE
Category
VULNERABILITY
First published
2026-06-26
Last reviewed
2026-06-26
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
technology, government, financial, healthcare, telecommunications, cloud-hosting
Target regions
Global
Detection rules
9
Indicators of compromise
16

Malware and tooling in Linux Kernel act_pedit Partial Copy-on-Write Page-Cache

Malware and tooling: packet_edit_meme

CVE-2026-46331 is an out-of-bounds write in the Linux kernel net/sched act_pedit traffic-control action (tcf_pedit_act). An unprivileged local user who can create a user namespace and obtain namespace-local CAP_NET_ADMIN can corrupt shared page-cache memory and poison the cached ELF image of a setuid-root binary (/bin/su) to gain root. Active exploitation is verified and a public PoC (packet_edit_meme) is available; fixed in v7.1-rc7.

How Linux Kernel act_pedit Partial Copy-on-Write Page-Cache works

CVE-2026-46331 ("pedit COW") is a partial copy-on-write page-cache corruption flaw in the Linux kernel's traffic-control (tc) packet-editing action, act_pedit. The vulnerable function tcf_pedit_act() computes the writable copy-on-write range for skb_ensure_writable() once before iterating the packet-editing key loop, using tcfp_off_max_hint. That hint does not account for the runtime header offset added by typed keys, whose offsets are only resolved against L2/L3/L4 headers during execution. As a result, edit writes can land outside the privately copied region and instead modify shared page-cache pages backing real on-disk files, including cached executable images. This is an out-of-bounds write (CWE-787; also tracked as CWE-122 heap-based overflow) introduced by kernel commit 899ee91156e5 and present from v5.18 through v7.1-rc6.

The public proof-of-concept, packet_edit_meme by GitHub user sgkdev, chains the bug into a reliable local privilege escalation. The attacker creates an unprivileged user namespace to obtain namespace-local CAP_NET_ADMIN, configures a pedit action with typed keys whose runtime offset exceeds the precomputed COW range, and feeds zero-copy file references (e.g. via sendfile) into the network stack to aim the corruption at the cached ELF image of the setuid-root /bin/su binary. The exploit overwrites the cached entry point with shellcode performing setgid(0) + setuid(0) + execve("/bin/sh"), yielding a root shell. The on-disk binary is never modified, so file-integrity checks pass and the corruption lives only in the page cache (evicted on reboot or vm.drop_caches). On Ubuntu, a --ubuntu flag bypasses AppArmor confinement by using aa-exec with permissive profiles (trinity, chrome, flatpak) to reach unprivileged user-namespace creation; Ubuntu 26.04 closes this path by enforcing kernel.apparmor_restrict_unprivileged_unconfined.

The fix relocates the skb_ensure_writable() write check inside the per-key loop where actual offsets are known, adds overflow validation on offset arithmetic, guards negative offsets with skb_cow() headroom COW, and linearizes shared fragments preemptively. The flaw was reserved 2026-05-13, discussed on the netdev mailing list in May 2026 as a routine data-corruption patch with no security flag, assigned CVE on merge June 16, 2026, and a weaponized public PoC appeared within a day. Red Hat issued security bulletin RHSB-2026-008 rating it Important and urging immediate patching.

MITRE ATT&CK techniques used in TL-2026-0951

Execution

T1059 Command and Scripting Interpreter; T1106 Native API

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism; T1611 Escape to Host

Defense Evasion

T1070 Indicator Removal; T1211 Exploitation for Stealth; T1564 Hide Artifacts

Discovery

T1082 System Information Discovery; T1083 File and Directory Discovery; T1518 Software Discovery

defense-impairment

T1553 Subvert Trust Controls; T1685 Disable or Modify Tools

stealth

T1574 Hijack Execution Flow

Resource Development

T1587 Develop Capabilities; T1588 Obtain Capabilities

Affected products and versions in Linux Kernel act_pedit Partial Copy-on-Write Page-Cache

  • Linux — Linux Kernel (net/sched act_pedit)
    Vulnerable versions: 5.18 through 7.1-rc6
    Fixed in: 7.1-rc7
  • Red Hat — Red Hat Enterprise Linux
    Vulnerable versions: 8; 9; 10 (6.12.0-228.el10)
    Fixed in: RHSA-2026:27353 (8); RHSA-2026:27789 (9); RHSA-2026:27288 (10)
  • Debian — Debian GNU/Linux
    Vulnerable versions: 11; 12; 13 trixie (6.12.90+deb13.1)
    Fixed in: 13 via DSA-6355-1
  • Canonical — Ubuntu
    Vulnerable versions: 18.04 through 24.04.4 (6.17.0-22)
    Fixed in: 26.04 mitigated via AppArmor (7.0.0-14-generic)

Remediation for Linux Kernel act_pedit Partial Copy-on-Write Page-Cache

Patches

  • Linux kernel v7.1-rc7 (upstream fix).
  • RHEL 10: RHSA-2026:27288; RHEL 9: RHSA-2026:27789; RHEL 8 / AlmaLinux 8: RHSA-2026:27353 / ALSA-2026:27353.
  • Debian 13: DSA-6355-1 (2026-06-21).

Immediate actions

  • Deploy vendor-fixed kernels (RHEL 8/9/10, AlmaLinux 8, Debian 13) and reboot — already-open root shells persist across page-cache drops, so reboot is required.
  • Where patching is delayed, block the act_pedit module: echo 'install act_pedit /bin/true' | sudo tee /etc/modprobe.d/disable-act_pedit.conf (only if tc pedit rules are not in use; verify with lsmod | grep act_pedit).
  • Restrict unprivileged user-namespace creation: user.max_user_namespaces=0 (EL) or kernel.unprivileged_userns_clone=0 (Debian/Ubuntu).

Workarounds

  • Blacklist the act_pedit module via /etc/modprobe.d.
  • Disable unprivileged user namespaces via sysctl.
  • Drop poisoned page cache with echo 3 > /proc/sys/vm/drop_caches (containment only, not remediation).

Longer-term hardening

  • Enforce kernel.apparmor_restrict_unprivileged_unconfined=1 on AppArmor systems to block the aa-exec permissive-profile bypass.
  • Audit tc/act_pedit usage and remove the module from hosts that do not perform traffic-control packet rewriting.
  • Deploy behavioral EDR detections for unexpected act_pedit module loads and tc execution by non-network users.

CVEs associated with Linux Kernel act_pedit Partial Copy-on-Write Page-Cache

CVE-2026-46331

Weaknesses (CWE) in Linux Kernel act_pedit Partial Copy-on-Write Page-Cache

CWE-787, CWE-122

Timeline of Linux Kernel act_pedit Partial Copy-on-Write Page-Cache

  • CVE-2026-46331 reserved.
  • Fix discussed on the netdev mailing list as a routine act_pedit data-corruption patch, with no security flag.
  • CVE-2026-46331 assigned at kernel merge; NVD record published. Root-cause commit 899ee91156e5; fixed in v7.1-rc7.
  • Weaponized public PoC packet_edit_meme published to GitHub (sgkdev) within a day of CVE assignment.
  • Red Hat security bulletin RHSB-2026-008 made public (rated Important); NVD record last modified.
  • Debian 13 (trixie) fixed via DSA-6355-1.
  • KernelCare rebootless patch entered active testing (not yet released to feeds); TuxCare technical analysis published.
  • Active exploitation verified across RHEL 10, Debian 13, and Ubuntu 24.04.4; reported by Cyber Security News and The Hacker News.

Sources cited for Linux Kernel act_pedit Partial Copy-on-Write Page-Cache

Threats related to Linux Kernel act_pedit Partial Copy-on-Write Page-Cache

Detection coverage for TL-2026-0951

As of 2026-06-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0951 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats