# Linux Kernel act_pedit COW Out-of-Bounds Write Enables Local Privilege Escalation to Root (CVE-2026-46331)

> CVE-2026-46331 ('Pedit COW') is an out-of-bounds write in the Linux kernel traffic-control packet-editing subsystem (act_pedit / tcf_pedit_act) that allows an unprivileged local attacker to corrupt page-cache memory backing setuid-root binaries, achieving local root without any on-disk modification. A weaponized public PoC (packet_edit_meme) was published on GitHub within 24 hours of CVE assignment on June 16, 2026, achieving reliable root on RHEL 8/9/10, Debian 11/12/13, and Ubuntu 18.04-26.04.

- **Published:** 2026-06-27T00:00:00Z
- **Last reviewed:** 2026-06-27T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0964
- **ID:** TL-2026-0964
- **Severity:** HIGH (CVSS 8.5)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-46331

## Description

CVE-2026-46331, dubbed 'Pedit COW', is a high-severity out-of-bounds write vulnerability in the Linux kernel traffic-control packet-editing action subsystem (net/sched, tcf_pedit_act). The root cause is a Copy-on-Write (COW) range miscalculation in tcf_pedit_act(): skb_ensure_writable() is called once before the per-key edit loop using tcfp_off_max_hint to pre-compute the private-copy region, but typed pedit keys resolve their final byte offsets only at execution time. When those runtime-resolved offsets exceed the pre-computed COW range, subsequent writes land directly on shared page-cache pages rather than the COW private copy, enabling arbitrary in-memory corruption of kernel-cached file content without any disk write.

The practical exploitation path is reliable and fully weaponized. An attacker holding only a local unprivileged shell creates a new user namespace via unshare(CLONE_NEWUSER | CLONE_NEWNET), which grants CAP_NET_ADMIN within that namespace on any Linux distribution with unprivileged user namespaces enabled by default (RHEL 8/9/10, Debian 11/12/13, Ubuntu 18.04-26.04). The attacker then auto-loads the act_pedit kernel module via a tc invocation, configures a cls_basic or matchall classifier with a malicious pedit action whose typed keys produce runtime offsets beyond the pre-computed COW range, and feeds zero-copy file-backed socket buffers referencing the page-cache pages of a setuid-root binary (/bin/su) into the network stack. The out-of-bounds write injects shellcode (setgid(0) -> setuid(0) -> execve('/bin/sh')) at the ELF entry point of the in-memory binary image. Invoking the corrupted setuid binary then executes the shellcode under UID 0.

The PoC 'packet_edit_meme' (GitHub: sgkdev/packet_edit_meme, primary file PACKET_EDIT_MEME.c) was published within 24 hours of CVE assignment. It requires no kernel module compilation, no pre-existing privileges beyond a local user shell, and ships an --ubuntu flag for AppArmor-protected environments. Author-verified root shells were achieved on RHEL 10.0 (kernel 6.12.0-228.el10), Debian 13 Trixie pre-patch (kernel 6.12.90+deb13.1), and Ubuntu 24.04.4 LTS (kernel 6.17.0-22).

A defining forensic characteristic of this exploit class is complete evasion of disk-based integrity controls. The on-disk setuid binary is never modified; corruption exists only in the kernel page cache. File-integrity monitors (AIDE, Tripwire) and kernel-level integrity mechanisms (IMA/EVM hash policy) return clean results because they verify the on-disk inode hash, not in-flight page-cache content. The corruption persists until the affected page is evicted or the system reboots. Dropping the page cache (echo 3 > /proc/sys/vm/drop_caches) removes the forensic artifact but cannot recover from an already-obtained root shell.

CVE-2026-46331 belongs to the same architectural class as Dirty Pipe (CVE-2022-0847) and DirtyClone (CVE-2026-43503). All three exploit failures to enforce COW semantics when kernel subsystems write into or reference shared page-cache pages: Dirty Pipe exploited pipe splicing via the PIPE_BUF_FLAG_CAN_MERGE path; DirtyClone exploited __pskb_copy_fclone() failing to preserve SKBFL_SHARED_FRAG during IPsec/TEE packet duplication; CVE-2026-46331 exploits act_pedit's pre-computed COW range that does not account for runtime key offset resolution.

The vulnerable kernel range spans v5.18 (regression introduced at commit 8b79647) through v7.1-rc6, covering virtually every modern enterprise Linux distribution. Upstream fixes are in v6.12.94, v6.18.36, v7.0.13, and v7.1-rc7+. The primary fix commit (899ee91156e5) relocates skb_ensure_writable() inside the per-key edit loop so the COW range is computed after each key's runtime offset resolves, adds arithmetic overflow checking, linearizes skbs with shared fragments upfront, and guards against INT_MIN negation on negative header offsets. Vendor patches shipped as RHSA-2026:27288 (RHEL 10), RHSA-2026:27789 (RHEL 9), RHSA-2026:27353 (RHEL 8), and Debian DSA-6355-1 (Trixie/Sid). Ubuntu USN advisories were being finalized as of June 27, 2026. KernelCare rebootless patch KCARE-27230 was in testing as of June 23, 2026.

Detection requires behavioral telemetry beyond file-hash FIM. Key signals include unprivileged user namespace creation (unshare -U -n) immediately followed by tc execution by a non-root user, act_pedit module loading on hosts where traffic shaping is not operationally required, and execution of setuid binaries not preceded by a PAM authentication event. Sysctl audit of user.max_user_namespaces and kernel.unprivileged_userns_clone provides a compensating control where rootless containers are not in use. No CISA KEV listing exists as of June 27, 2026; no confirmed threat actor exploitation has been documented, though the turnkey weaponized PoC substantially elevates near-term risk for post-initial-access privilege escalation on multi-tenant Linux systems.

## MITRE ATT&CK

- T1068 Exploitation for Privilege Escalation
- T1548 Abuse Elevation Control Mechanism
- T1548 Abuse Elevation Control Mechanism
- T1027 Obfuscated Files or Information
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1055 Process Injection
- T1014 Rootkit
- T1036 Masquerading
- T1601 Modify System Image
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1203 Exploitation for Client Execution
- T1588 Obtain Capabilities
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1057 Process Discovery
- T1518 Software Discovery
- T1543 Create or Modify System Process
- T1098 Account Manipulation
- T1021 Remote Services
- T1005 Data from Local System
- T1565 Data Manipulation

## Sources

- [The Hacker News — New Linux pedit COW Exploit Enables Local Privilege Escalation](https://thehackernews.com/2026/06/new-linux-pedit-cow-exploit-enables.html)
- [NVD Detail — CVE-2026-46331](https://nvd.nist.gov/vuln/detail/CVE-2026-46331)
- [Red Hat Security Bulletin RHSB-2026-008 — pedit COW Kernel Privilege Escalation](https://access.redhat.com/security/vulnerabilities/RHSB-2026-008)
- [Debian Security Advisory DSA-6355-1 — Linux kernel (act_pedit OOB write)](https://www.debian.org/security/2026/dsa-6355)
- [Ubuntu Security — CVE-2026-46331](https://ubuntu.com/security/CVE-2026-46331)
- [GitHub PoC — sgkdev/packet_edit_meme](https://github.com/sgkdev/packet_edit_meme)
- [Kernel fix commit 899ee91 — net/sched: act_pedit: fix COW range before per-key loop](https://git.kernel.org/stable/c/899ee91156e57784090c5565e4f31bd7dbffbc5a)
- [TuxCare — Pedit COW CVE-2026-46331 Technical Analysis](https://tuxcare.com/blog/pedit-cow-cve/)
- [CyberPress — Packet Edit Meme Linux Kernel Flaw Enables Root Access](https://cyberpress.org/packet_edit_meme-linux-kernel-flaw/)
- [SC Media — Two Linux Kernel Flaw PoCs Published Enabling Local Privilege Escalation](https://www.scworld.com/news/2-linux-kernel-flaw-pocs-published-enabling-local-privilege-escalation)
- [GBHackers — Critical Linux Kernel Flaw Allows Privilege Escalation Without Disk Write](https://gbhackers.com/critical-linux-kernel-flaw-2/)
- [The CyberSec Guru — Linux LPE Pedit COW and DirtyClone: CVE-2026-46331 and CVE-2026-43503](https://thecybersecguru.com/news/linux-lpe-pedit-cow-dirtyclone-cve-2026-46331-cve-2026-43503/)
- [Mallory.ai — CVE-2026-46331 Vulnerability Detail](https://www.mallory.ai/vulnerabilities/019ecf9f-916a-7e2d-9bae-7dad3078d53b)
- [OpenCVE — CVE-2026-46331](https://app.opencve.io/cve/CVE-2026-46331)
- [Snyk — SNYK-RHEL10-KERNEL-17378738 (CVE-2026-46331)](https://security.snyk.io/vuln/SNYK-RHEL10-KERNEL-17378738)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0964