Linux Kernel act_pedit COW Out-of-Bounds Write Enables Local Privilege Escalation to Root (CVE-2026-46331)

Linux Kernel act_pedit COW Out-of-Bounds Write Enables Local (TL-2026-0964), also tracked as Pedit COW, is a high-severity software vulnerability scored CVSS 8.5, first published 2026-06-27. It has no confirmed attribution, affects Linux Kernel Linux Kernel (net/sched act_pedit), references 1 CVE (CVE-2026-46331), maps to 22 MITRE ATT&CK techniques (T1005, T1014, T1021), and is covered by 9 detection rules and 17 indicators of compromise.

Key facts for TL-2026-0964

Threat ID
TL-2026-0964
Also known as
Pedit COW, packet_edit_meme
Severity
HIGH
CVSS
8.5 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-06-27
Last reviewed
2026-06-27
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
technology, government administration, finance, health, education, cloud, telecoms, defense, critical-infrastructure, enterprise
Target regions
Global
Detection rules
9
Indicators of compromise
17

Malware and tooling in Linux Kernel act_pedit COW Out-of-Bounds Write Enables Local

Malware and tooling: packet_edit_meme

CVE-2026-46331 ('Pedit COW') is an out-of-bounds write in the Linux kernel traffic-control packet-editing subsystem (act_pedit / tcf_pedit_act) that allows an unprivileged local attacker to corrupt page-cache memory backing setuid-root binaries, achieving local root without any on-disk modification. A weaponized public PoC (packet_edit_meme) was published on GitHub within 24 hours of CVE assignment on June 16, 2026, achieving reliable root on RHEL 8/9/10, Debian 11/12/13, and Ubuntu 18.04-26.04.

How Linux Kernel act_pedit COW Out-of-Bounds Write Enables Local works

CVE-2026-46331, dubbed 'Pedit COW', is a high-severity out-of-bounds write vulnerability in the Linux kernel traffic-control packet-editing action subsystem (net/sched, tcf_pedit_act). The root cause is a Copy-on-Write (COW) range miscalculation in tcf_pedit_act(): skb_ensure_writable() is called once before the per-key edit loop using tcfp_off_max_hint to pre-compute the private-copy region, but typed pedit keys resolve their final byte offsets only at execution time. When those runtime-resolved offsets exceed the pre-computed COW range, subsequent writes land directly on shared page-cache pages rather than the COW private copy, enabling arbitrary in-memory corruption of kernel-cached file content without any disk write.

The practical exploitation path is reliable and fully weaponized. An attacker holding only a local unprivileged shell creates a new user namespace via unshare(CLONE_NEWUSER | CLONE_NEWNET), which grants CAP_NET_ADMIN within that namespace on any Linux distribution with unprivileged user namespaces enabled by default (RHEL 8/9/10, Debian 11/12/13, Ubuntu 18.04-26.04). The attacker then auto-loads the act_pedit kernel module via a tc invocation, configures a cls_basic or matchall classifier with a malicious pedit action whose typed keys produce runtime offsets beyond the pre-computed COW range, and feeds zero-copy file-backed socket buffers referencing the page-cache pages of a setuid-root binary (/bin/su) into the network stack. The out-of-bounds write injects shellcode (setgid(0) -> setuid(0) -> execve('/bin/sh')) at the ELF entry point of the in-memory binary image. Invoking the corrupted setuid binary then executes the shellcode under UID 0.

The PoC 'packet_edit_meme' (GitHub: sgkdev/packet_edit_meme, primary file PACKET_EDIT_MEME.c) was published within 24 hours of CVE assignment. It requires no kernel module compilation, no pre-existing privileges beyond a local user shell, and ships an --ubuntu flag for AppArmor-protected environments. Author-verified root shells were achieved on RHEL 10.0 (kernel 6.12.0-228.el10), Debian 13 Trixie pre-patch (kernel 6.12.90+deb13.1), and Ubuntu 24.04.4 LTS (kernel 6.17.0-22).

A defining forensic characteristic of this exploit class is complete evasion of disk-based integrity controls. The on-disk setuid binary is never modified; corruption exists only in the kernel page cache. File-integrity monitors (AIDE, Tripwire) and kernel-level integrity mechanisms (IMA/EVM hash policy) return clean results because they verify the on-disk inode hash, not in-flight page-cache content. The corruption persists until the affected page is evicted or the system reboots. Dropping the page cache (echo 3 > /proc/sys/vm/drop_caches) removes the forensic artifact but cannot recover from an already-obtained root shell.

CVE-2026-46331 belongs to the same architectural class as Dirty Pipe (CVE-2022-0847) and DirtyClone (CVE-2026-43503). All three exploit failures to enforce COW semantics when kernel subsystems write into or reference shared page-cache pages: Dirty Pipe exploited pipe splicing via the PIPE_BUF_FLAG_CAN_MERGE path; DirtyClone exploited __pskb_copy_fclone() failing to preserve SKBFL_SHARED_FRAG during IPsec/TEE packet duplication; CVE-2026-46331 exploits act_pedit's pre-computed COW range that does not account for runtime key offset resolution.

The vulnerable kernel range spans v5.18 (regression introduced at commit 8b79647) through v7.1-rc6, covering virtually every modern enterprise Linux distribution. Upstream fixes are in v6.12.94, v6.18.36, v7.0.13, and v7.1-rc7+. The primary fix commit (899ee91156e5) relocates skb_ensure_writable() inside the per-key edit loop so the COW range is computed after each key's runtime offset resolves, adds arithmetic overflow checking, linearizes skbs with shared fragments upfront, and guards against INT_MIN negation on negative header offsets. Vendor patches shipped as RHSA-2026:27288 (RHEL 10), RHSA-2026:27789 (RHEL 9), RHSA-2026:27353 (RHEL 8), and Debian DSA-6355-1 (Trixie/Sid). Ubuntu USN advisories were being finalized as of June 27, 2026. KernelCare rebootless patch KCARE-27230 was in testing as of June 23, 2026.

Detection requires behavioral telemetry beyond file-hash FIM. Key signals include unprivileged user namespace creation (unshare -U -n) immediately followed by tc execution by a non-root user, act_pedit module loading on hosts where traffic shaping is not operationally required, and execution of setuid binaries not preceded by a PAM authentication event. Sysctl audit of user.max_user_namespaces and kernel.unprivileged_userns_clone provides a compensating control where rootless containers are not in use. No CISA KEV listing exists as of June 27, 2026; no confirmed threat actor exploitation has been documented, though the turnkey weaponized PoC substantially elevates near-term risk for post-initial-access privilege escalation on multi-tenant Linux systems.

MITRE ATT&CK techniques used in TL-2026-0964

Collection

T1005 Data from Local System

Defense Evasion

T1014 Rootkit; T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1070 Indicator Removal

Lateral Movement

T1021 Remote Services

Discovery

T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1518 Software Discovery

Execution

T1059 Command and Scripting Interpreter; T1106 Native API; T1203 Exploitation for Client Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism

Persistence

T1098 Account Manipulation; T1543 Create or Modify System Process

privilege-escalation

T1548 Abuse Elevation Control Mechanism

Impact

T1565 Data Manipulation

Resource Development

T1588 Obtain Capabilities

defense-impairment

T1601 Modify System Image; T1685 Disable or Modify Tools

Affected products and versions in Linux Kernel act_pedit COW Out-of-Bounds Write Enables Local

  • Linux Kernel — Linux Kernel (net/sched act_pedit)
    Vulnerable versions: 5.18 through 7.1-rc6; 4.19.244+ (stable branch); 5.4.195+ (stable branch); 5.10.117+ (stable branch); 5.15.41+ (stable branch); 5.17.9+ (stable branch)
    Fixed in: 6.12.94; 6.18.36; 7.0.13; 7.1-rc7+
  • Red Hat — Red Hat Enterprise Linux 10
    Vulnerable versions: RHEL 10.0 (kernel 6.12.0-228.el10)
    Fixed in: Patched via RHSA-2026:27288
  • Red Hat — Red Hat Enterprise Linux 9
    Vulnerable versions: RHEL 9.x
    Fixed in: Patched via RHSA-2026:27789
  • Red Hat — Red Hat Enterprise Linux 8
    Vulnerable versions: RHEL 8.x
    Fixed in: Patched via RHSA-2026:27353
  • AlmaLinux — AlmaLinux 8
    Vulnerable versions: AlmaLinux 8.x
    Fixed in: Patched via ALSA-2026:27353
  • Rocky Linux — Rocky Linux
    Vulnerable versions: Rocky Linux 8.x; Rocky Linux 9.x
  • Debian — Debian GNU/Linux 11 (Bullseye)
    Vulnerable versions: 5.10.257-1
  • Debian — Debian GNU/Linux 12 (Bookworm)
    Vulnerable versions: 6.1.174-1
  • Debian — Debian GNU/Linux 13 (Trixie)
    Vulnerable versions: 6.12.86-1 and earlier
    Fixed in: 6.12.94-1 (DSA-6355-1)
  • Canonical — Ubuntu Linux
    Vulnerable versions: 18.04 LTS (Bionic); 20.04 LTS (Focal); 22.04 LTS (Jammy); 24.04 LTS (Noble) — confirmed exploitable on 6.17.0-22; 25.10 (Questing); 26.04 LTS (Resolute)

Remediation for Linux Kernel act_pedit COW Out-of-Bounds Write Enables Local

Patches

  • RHSA-2026:27288 — RHEL 10 kernel update
  • RHSA-2026:27789 — RHEL 9 kernel update
  • RHSA-2026:27353 — RHEL 8 / AlmaLinux 8 kernel update
  • ALSA-2026:27353 — AlmaLinux 8 kernel update
  • DSA-6355-1 — Debian 13 Trixie kernel update (6.12.94-1)
  • Upstream fix commits: 899ee91156e5, 2bec122b9fb9, 3dee9d0c198f, b198ed4e5258
  • KernelCare KCARE-27230 — rebootless live patch (in testing as of 2026-06-23)

Immediate actions

  • Apply vendor kernel patch and reboot immediately (only complete remediation): RHSA-2026:27288 (RHEL 10), RHSA-2026:27789 (RHEL 9), RHSA-2026:27353 (RHEL 8), DSA-6355-1 (Debian 13/Sid)
  • Blacklist act_pedit module on hosts where tc packet editing is not operationally required: echo 'install act_pedit /bin/true' | tee /etc/modprobe.d/disable-act_pedit.conf
  • Restrict unprivileged user namespaces if rootless containers are not in use: sysctl -w user.max_user_namespaces=0 (RHEL) or sysctl -w kernel.unprivileged_userns_clone=0 (Debian/Ubuntu)
  • Enable kernel audit rules on /sbin/tc execution and unshare(2) syscall: auditctl -w /sbin/tc -p x -k tc_exec && auditctl -a always,exit -F arch=b64 -S unshare -k userns_create
  • Check for active exploitation: grep act_pedit /proc/modules; review audit logs for non-root tc invocations

Workarounds

  • Blacklist act_pedit kernel module: echo 'install act_pedit /bin/true' >> /etc/modprobe.d/blacklist-act-pedit.conf
  • Disable unprivileged user namespaces (breaks rootless containers): sysctl -w kernel.unprivileged_userns_clone=0
  • Set max_user_namespaces=0 on RHEL: sysctl -w user.max_user_namespaces=0
  • Post-incident page-cache flush (removes corruption artifact, not active compromise): sudo sh -c 'echo 3 > /proc/sys/vm/drop_caches'

Longer-term hardening

  • Deploy runtime memory integrity monitoring (not hash-based FIM) to detect in-memory binary corruption
  • Audit user namespace policy enterprise-wide: catalog all workloads requiring unprivileged user namespaces before restricting
  • Evaluate KernelCare or KSPLICE live patching for rebootless remediation on production workloads (KCARE-27230 in testing)
  • Implement detection rules for tc/pedit activity from non-root accounts in SIEM and EDR platforms
  • Review and harden AppArmor/SELinux profiles to restrict access to tc and act_pedit for non-administrative users

CVEs associated with Linux Kernel act_pedit COW Out-of-Bounds Write Enables Local

CVE-2026-46331

Weaknesses (CWE) in Linux Kernel act_pedit COW Out-of-Bounds Write Enables Local

CWE-787

Timeline of Linux Kernel act_pedit COW Out-of-Bounds Write Enables Local

  • Dirty Pipe (CVE-2022-0847) publicly disclosed — establishes the page-cache corruption via COW bypass attack class that CVE-2026-46331 belongs to; raises broad awareness of in-memory binary corruption techniques in the Linux kernel.
  • Upstream fix for CVE-2026-46331 submitted to the Linux netdev mailing list framed as a routine data-corruption bugfix with no CVE tag or security flag; the original regression (commit 8b79647) had introduced the partial COW range calculation in v5.18.
  • DirtyClone (CVE-2026-43503) identified — a closely related page-cache corruption technique abusing __pskb_copy_fclone() in IPsec/TEE packet duplication; its public disclosure heightens researcher attention on net/sched page-cache handling.
  • CVE-2026-46331 assigned by kernel.org CNA at upstream merge time; Red Hat flags as RHSB-2026-008 with 'Important' severity; CVSS 4.0 score of 8.5 calculated (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H).
  • Researcher 'sgkdev' publishes weaponized PoC 'packet_edit_meme' (PACKET_EDIT_MEME.c) on GitHub within 24 hours of CVE assignment; PoC achieves confirmed root shells on RHEL 10.0, Debian 13 Trixie (pre-patch), and Ubuntu 24.04.4 LTS; includes --ubuntu flag for AppArmor bypass.
  • SC Media, GBHackers, CyberPress, and Mallory.ai publish technical coverage; PoC confirmed by independent researchers; EPSS score remains low (~0.00291) but real-world risk assessed as significantly elevated due to turnkey weaponized exploit availability.
  • TuxCare / KernelCare rebootless patch KCARE-27230 enters internal testing; not yet released to public live-patching feed as of this date; provides remediation path for production workloads that cannot be rebooted immediately.
  • Debian DSA-6355-1 issued for Trixie/Sid (kernel 6.12.94-1); Ubuntu security notices published; RHEL patches (RHSA-2026:27288/27789/27353) already available from June 16; AlmaLinux ALSA-2026:27353 issued.
  • The Hacker News publishes prominent coverage triggering broad enterprise awareness; patch pressure on Linux system administrators significantly increases.
  • As of research date CVE-2026-46331 is NOT listed in CISA's Known Exploited Vulnerabilities catalog; no confirmed threat actor exploitation documented; Debian 11/12 and Ubuntu LTS remain unpatched; Debian Bullseye and Bookworm backport patches pending.

Sources cited for Linux Kernel act_pedit COW Out-of-Bounds Write Enables Local

Threats related to Linux Kernel act_pedit COW Out-of-Bounds Write Enables Local

Detection coverage for TL-2026-0964

As of 2026-06-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0964 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats