Linux Kernel act_pedit Partial Copy-on-Write Page-Cache Corruption Local Privilege Escalation (CVE-2026-46331, "pedit COW")
Linux Kernel act_pedit Partial Copy-on-Write Page-Cache (TL-2026-0951), also tracked as pedit COW, is a high-severity software vulnerability, first published 2026-06-26. It has no confirmed attribution, affects Linux Linux Kernel (net/sched act_pedit), references 1 CVE (CVE-2026-46331), maps to 16 MITRE ATT&CK techniques (T1059, T1068, T1070), and is covered by 9 detection rules and 16 indicators of compromise.
Key facts for TL-2026-0951
- Threat ID
- TL-2026-0951
- Also known as
- pedit COW, packet_edit_meme
- Severity
- HIGH
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-06-26
- Last reviewed
- 2026-06-26
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- technology, government, financial, healthcare, telecommunications, cloud-hosting
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 16
Malware and tooling in Linux Kernel act_pedit Partial Copy-on-Write Page-Cache
Malware and tooling: packet_edit_meme
CVE-2026-46331 is an out-of-bounds write in the Linux kernel net/sched act_pedit traffic-control action (tcf_pedit_act). An unprivileged local user who can create a user namespace and obtain namespace-local CAP_NET_ADMIN can corrupt shared page-cache memory and poison the cached ELF image of a setuid-root binary (/bin/su) to gain root. Active exploitation is verified and a public PoC (packet_edit_meme) is available; fixed in v7.1-rc7.
How Linux Kernel act_pedit Partial Copy-on-Write Page-Cache works
CVE-2026-46331 ("pedit COW") is a partial copy-on-write page-cache corruption flaw in the Linux kernel's traffic-control (tc) packet-editing action, act_pedit. The vulnerable function tcf_pedit_act() computes the writable copy-on-write range for skb_ensure_writable() once before iterating the packet-editing key loop, using tcfp_off_max_hint. That hint does not account for the runtime header offset added by typed keys, whose offsets are only resolved against L2/L3/L4 headers during execution. As a result, edit writes can land outside the privately copied region and instead modify shared page-cache pages backing real on-disk files, including cached executable images. This is an out-of-bounds write (CWE-787; also tracked as CWE-122 heap-based overflow) introduced by kernel commit 899ee91156e5 and present from v5.18 through v7.1-rc6.
The public proof-of-concept, packet_edit_meme by GitHub user sgkdev, chains the bug into a reliable local privilege escalation. The attacker creates an unprivileged user namespace to obtain namespace-local CAP_NET_ADMIN, configures a pedit action with typed keys whose runtime offset exceeds the precomputed COW range, and feeds zero-copy file references (e.g. via sendfile) into the network stack to aim the corruption at the cached ELF image of the setuid-root /bin/su binary. The exploit overwrites the cached entry point with shellcode performing setgid(0) + setuid(0) + execve("/bin/sh"), yielding a root shell. The on-disk binary is never modified, so file-integrity checks pass and the corruption lives only in the page cache (evicted on reboot or vm.drop_caches). On Ubuntu, a --ubuntu flag bypasses AppArmor confinement by using aa-exec with permissive profiles (trinity, chrome, flatpak) to reach unprivileged user-namespace creation; Ubuntu 26.04 closes this path by enforcing kernel.apparmor_restrict_unprivileged_unconfined.
The fix relocates the skb_ensure_writable() write check inside the per-key loop where actual offsets are known, adds overflow validation on offset arithmetic, guards negative offsets with skb_cow() headroom COW, and linearizes shared fragments preemptively. The flaw was reserved 2026-05-13, discussed on the netdev mailing list in May 2026 as a routine data-corruption patch with no security flag, assigned CVE on merge June 16, 2026, and a weaponized public PoC appeared within a day. Red Hat issued security bulletin RHSB-2026-008 rating it Important and urging immediate patching.
MITRE ATT&CK techniques used in TL-2026-0951
Execution
T1059 Command and Scripting Interpreter; T1106 Native API
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism; T1611 Escape to Host
Defense Evasion
T1070 Indicator Removal; T1211 Exploitation for Stealth; T1564 Hide Artifacts
Discovery
T1082 System Information Discovery; T1083 File and Directory Discovery; T1518 Software Discovery
defense-impairment
T1553 Subvert Trust Controls; T1685 Disable or Modify Tools
stealth
Resource Development
Affected products and versions in Linux Kernel act_pedit Partial Copy-on-Write Page-Cache
- Linux — Linux Kernel (net/sched act_pedit)
Vulnerable versions: 5.18 through 7.1-rc6
Fixed in: 7.1-rc7 - Red Hat — Red Hat Enterprise Linux
Vulnerable versions: 8; 9; 10 (6.12.0-228.el10)
Fixed in: RHSA-2026:27353 (8); RHSA-2026:27789 (9); RHSA-2026:27288 (10) - Debian — Debian GNU/Linux
Vulnerable versions: 11; 12; 13 trixie (6.12.90+deb13.1)
Fixed in: 13 via DSA-6355-1 - Canonical — Ubuntu
Vulnerable versions: 18.04 through 24.04.4 (6.17.0-22)
Fixed in: 26.04 mitigated via AppArmor (7.0.0-14-generic)
Remediation for Linux Kernel act_pedit Partial Copy-on-Write Page-Cache
Patches
- Linux kernel v7.1-rc7 (upstream fix).
- RHEL 10: RHSA-2026:27288; RHEL 9: RHSA-2026:27789; RHEL 8 / AlmaLinux 8: RHSA-2026:27353 / ALSA-2026:27353.
- Debian 13: DSA-6355-1 (2026-06-21).
Immediate actions
- Deploy vendor-fixed kernels (RHEL 8/9/10, AlmaLinux 8, Debian 13) and reboot — already-open root shells persist across page-cache drops, so reboot is required.
- Where patching is delayed, block the act_pedit module: echo 'install act_pedit /bin/true' | sudo tee /etc/modprobe.d/disable-act_pedit.conf (only if tc pedit rules are not in use; verify with lsmod | grep act_pedit).
- Restrict unprivileged user-namespace creation: user.max_user_namespaces=0 (EL) or kernel.unprivileged_userns_clone=0 (Debian/Ubuntu).
Workarounds
- Blacklist the act_pedit module via /etc/modprobe.d.
- Disable unprivileged user namespaces via sysctl.
- Drop poisoned page cache with echo 3 > /proc/sys/vm/drop_caches (containment only, not remediation).
Longer-term hardening
- Enforce kernel.apparmor_restrict_unprivileged_unconfined=1 on AppArmor systems to block the aa-exec permissive-profile bypass.
- Audit tc/act_pedit usage and remove the module from hosts that do not perform traffic-control packet rewriting.
- Deploy behavioral EDR detections for unexpected act_pedit module loads and tc execution by non-network users.
CVEs associated with Linux Kernel act_pedit Partial Copy-on-Write Page-Cache
Weaknesses (CWE) in Linux Kernel act_pedit Partial Copy-on-Write Page-Cache
CWE-787, CWE-122
Timeline of Linux Kernel act_pedit Partial Copy-on-Write Page-Cache
- CVE-2026-46331 reserved.
- Fix discussed on the netdev mailing list as a routine act_pedit data-corruption patch, with no security flag.
- CVE-2026-46331 assigned at kernel merge; NVD record published. Root-cause commit 899ee91156e5; fixed in v7.1-rc7.
- Weaponized public PoC packet_edit_meme published to GitHub (sgkdev) within a day of CVE assignment.
- Red Hat security bulletin RHSB-2026-008 made public (rated Important); NVD record last modified.
- Debian 13 (trixie) fixed via DSA-6355-1.
- KernelCare rebootless patch entered active testing (not yet released to feeds); TuxCare technical analysis published.
- Active exploitation verified across RHEL 10, Debian 13, and Ubuntu 24.04.4; reported by Cyber Security News and The Hacker News.
Sources cited for Linux Kernel act_pedit Partial Copy-on-Write Page-Cache
- New Linux pedit COW Exploit Allows Attackers to Gain System Root Access
- CVE-2026-46331 Detail
- RHSB-2026-008 Traffic Control Privilege Escalation - Linux Kernel (CVE-2026-46331)
- New Linux pedit COW Exploit Enables Root Access by Poisoning Cached Binaries
- pedit-cow (CVE-2026-46331): Linux tc Flaw Grants Root
- Linux CVE-2026-46331 Explained: Pedit COW Vulnerability Grants Root Access
- CVE-2026-46331 - Vulnerability Details
- Linux kernel net/sched pedit partial COW page cache corruption (CVE-2026-46331)
- Upstream fix commit (net/sched act_pedit COW)
- packet_edit_meme public PoC
Threats related to Linux Kernel act_pedit Partial Copy-on-Write Page-Cache
- Linux Kernel act_pedit COW Out-of-Bounds Write Enables Local Privilege Escalation to Root (CVE-2026-46331)
- DirtyClone (CVE-2026-43503): Linux Kernel Packet-Cloning Page-Cache Write Enables Local Privilege Escalation to Root via IPsec ESP
- CVE-2026-23111: Linux Kernel nf_tables Use-After-Free Enables Local Privilege Escalation and Container Escape
- Linux Kernel 'Copy Fail' Local Privilege Escalation (CVE-2026-31431) — algif_aead 4-Byte Page Cache Write to setuid Root
- DirtyClone Linux Kernel Local Privilege Escalation via __pskb_copy_fclone() (CVE-2026-43503)
- CVE-2026-53359 ("Januscape") - 16-Year-Old Linux KVM Shadow MMU Use-After-Free Exploited as Zero-Day
Detection coverage for TL-2026-0951
As of 2026-06-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0951 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.