# Linux Kernel act_pedit Partial Copy-on-Write Page-Cache Corruption Local Privilege Escalation (CVE-2026-46331, "pedit COW")

> CVE-2026-46331 is an out-of-bounds write in the Linux kernel net/sched act_pedit traffic-control action (tcf_pedit_act). An unprivileged local user who can create a user namespace and obtain namespace-local CAP_NET_ADMIN can corrupt shared page-cache memory and poison the cached ELF image of a setuid-root binary (/bin/su) to gain root. Active exploitation is verified and a public PoC (packet_edit_meme) is available; fixed in v7.1-rc7.

- **Published:** 2026-06-26T00:00:00Z
- **Last reviewed:** 2026-06-26T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0951
- **ID:** TL-2026-0951
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-46331

## Description

CVE-2026-46331 ("pedit COW") is a partial copy-on-write page-cache corruption flaw in the Linux kernel's traffic-control (tc) packet-editing action, act_pedit. The vulnerable function tcf_pedit_act() computes the writable copy-on-write range for skb_ensure_writable() once before iterating the packet-editing key loop, using tcfp_off_max_hint. That hint does not account for the runtime header offset added by typed keys, whose offsets are only resolved against L2/L3/L4 headers during execution. As a result, edit writes can land outside the privately copied region and instead modify shared page-cache pages backing real on-disk files, including cached executable images. This is an out-of-bounds write (CWE-787; also tracked as CWE-122 heap-based overflow) introduced by kernel commit 899ee91156e5 and present from v5.18 through v7.1-rc6.

The public proof-of-concept, packet_edit_meme by GitHub user sgkdev, chains the bug into a reliable local privilege escalation. The attacker creates an unprivileged user namespace to obtain namespace-local CAP_NET_ADMIN, configures a pedit action with typed keys whose runtime offset exceeds the precomputed COW range, and feeds zero-copy file references (e.g. via sendfile) into the network stack to aim the corruption at the cached ELF image of the setuid-root /bin/su binary. The exploit overwrites the cached entry point with shellcode performing setgid(0) + setuid(0) + execve("/bin/sh"), yielding a root shell. The on-disk binary is never modified, so file-integrity checks pass and the corruption lives only in the page cache (evicted on reboot or vm.drop_caches). On Ubuntu, a --ubuntu flag bypasses AppArmor confinement by using aa-exec with permissive profiles (trinity, chrome, flatpak) to reach unprivileged user-namespace creation; Ubuntu 26.04 closes this path by enforcing kernel.apparmor_restrict_unprivileged_unconfined.

The fix relocates the skb_ensure_writable() write check inside the per-key loop where actual offsets are known, adds overflow validation on offset arithmetic, guards negative offsets with skb_cow() headroom COW, and linearizes shared fragments preemptively. The flaw was reserved 2026-05-13, discussed on the netdev mailing list in May 2026 as a routine data-corruption patch with no security flag, assigned CVE on merge June 16, 2026, and a weaponized public PoC appeared within a day. Red Hat issued security bulletin RHSB-2026-008 rating it Important and urging immediate patching.

## MITRE ATT&CK

- T1588 Obtain Capabilities
- T1587 Develop Capabilities
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1068 Exploitation for Privilege Escalation
- T1548 Abuse Elevation Control Mechanism
- T1611 Escape to Host
- T1211 Exploitation for Stealth
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1553 Subvert Trust Controls
- T1564 Hide Artifacts
- T1574 Hijack Execution Flow
- T1082 System Information Discovery
- T1518 Software Discovery
- T1083 File and Directory Discovery

## Sources

- [New Linux pedit COW Exploit Allows Attackers to Gain System Root Access](https://cybersecuritynews.com/linux-pedit-cow-exploit/)
- [CVE-2026-46331 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-46331)
- [RHSB-2026-008 Traffic Control Privilege Escalation - Linux Kernel (CVE-2026-46331)](https://access.redhat.com/security/vulnerabilities/RHSB-2026-008)
- [New Linux pedit COW Exploit Enables Root Access by Poisoning Cached Binaries](https://thehackernews.com/2026/06/new-linux-pedit-cow-exploit-enables.html)
- [pedit-cow (CVE-2026-46331): Linux tc Flaw Grants Root](https://tuxcare.com/blog/pedit-cow-cve/)
- [Linux CVE-2026-46331 Explained: Pedit COW Vulnerability Grants Root Access](https://www.cyasha.com/linux-cve-2026-46331-pedit-cow-vulnerability/)
- [CVE-2026-46331 - Vulnerability Details](https://app.opencve.io/cve/CVE-2026-46331)
- [Linux kernel net/sched pedit partial COW page cache corruption (CVE-2026-46331)](https://www.mallory.ai/vulnerabilities/019ecf9f-916a-7e2d-9bae-7dad3078d53b)
- [Upstream fix commit (net/sched act_pedit COW)](https://git.kernel.org/stable/c/2bec122b9fb91507a758ab5e3e5c4fbe7cb3f61b)
- [packet_edit_meme public PoC](https://github.com/sgkdev/packet_edit_meme)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0951