Linux act_pedit OOB Write Poisons Page Cache, Hands Local Users Root

A local privilege escalation in the Linux kernel's traffic-control subsystem is being actively weaponized via public proof-of-concept code, and the path to root runs through the page cache.

CVE-2026-46331, dubbed "pedit COW," is an out-of-bounds write in act_pedit — the packet-editing action exposed through the tc netlink interface. The bug lets an unprivileged user with CAP_NET_ADMIN in a user namespace (granted by default on most desktop distros) write past the bounds of a kernel-side buffer and corrupt shared page-cache memory backing on-disk files.

That last part is the interesting bit.

Rather than hijacking control flow inside the kernel — the usual LPE playbook — the published exploit borrows the trick that made Dirty COW (CVE-2016-5195) so durable: corrupt the cached copy of a privileged binary on disk, then execute it. The kernel happily serves the poisoned page back to userland. SUID /usr/bin/su and /usr/bin/pkexec are the obvious targets in the PoC, but anything mapped read-only and executed with elevated privileges is fair game.

The CVE was assigned June 16. A working exploit was on GitHub within roughly 24 hours. Red Hat scored the flaw 7.8 CVSSv3 (High) under their advisory, citing local attack vector, low complexity, and no user interaction.

Affected kernels: 5.15 through 6.10.x prior to the backported fixes. The upstream patch landed in 6.10.7 and was backported to the 6.6, 6.1, 5.15, and 5.10 LTS branches. Distro-specific fixed packages:

• Ubuntu: linux-image-6.8.0-49 (22.04/24.04)
• Debian bookworm: linux 6.1.115-1
• RHEL 9: kernel-5.14.0-503.16.1.el9_5
• SUSE SLE 15 SP6: kernel-default-6.4.0-150600.23.30.1

The bug was reported by researcher Lin Ma of NUS, who also disclosed two related act_* issues earlier in the year. (Ma has not yet published a writeup; this is being tracked via the kernel CVE list.)

Mitigation, if you can't patch immediately:

1. Disable unprivileged user namespaces. On Debian/Ubuntu: sysctl kernel.unprivileged_userns_clone=0. On RHEL: sysctl user.max_user_namespaces=0.
2. Blacklist the act_pedit module if traffic shaping isn't in use: echo 'install act_pedit /bin/true' >> /etc/modprobe.d/blacklist-pedit.conf.
3. Audit for unexpected modifications to SUID binaries — though page-cache poisoning doesn't touch disk, a reboot clears the corruption, which is itself a forensic tell.
4. Watch for tc filter add calls from non-root UIDs in audit logs.

Container operators should note that the bug is reachable from inside containers with CAP_NET_ADMIN, which includes most Kubernetes CNI sidecars and any pod running with hostNetwork: true. Default Docker containers (no --privileged, no --cap-add=NET_ADMIN) are not affected.

Patch now. The PoC is reliable, the exploit primitive is generic, and page-cache corruption survives detection by most EDR products that watch for control-flow hijacks.