New Linux ‘pedit COW’ Exploit Grants Root Access by Poisoning Cached Binaries

A critical vulnerability in the Linux kernel’s traffic-control subsystem, tracked as CVE-2026-46331 and nicknamed ‘pedit COW,’ allows a local unprivileged user to gain root access on affected systems. The flaw is an out-of-bounds write in the packet-editing action (act_pedit) that corrupts shared page-cache memory, enabling an attacker to poison the cached copy of a setuid root binary (e.g., /bin/su) without touching the file on disk. A public, working exploit appeared within a day of the CVE assignment on June 16, 2026.

The exploit requires two conditions: the act_pedit module must be loadable, and unprivileged user namespaces must be enabled, granting the attacker CAP_NET_ADMIN. On tested RHEL and Debian targets, both conditions were present. The vulnerability works because the kernel function tcf_pedit_act() checks the writable range before final offsets are known, causing writes to land outside the privately copied region and modify a shared page-cache page.

Affected systems include RHEL 8, 9, and 10; Debian 13 (trixie); and Ubuntu 18.04 through 26.04. Debian has fixed trixie, but Debian 11 and 12 remain vulnerable. Red Hat rates the flaw as important. Mitigations include blocking the act_pedit module or disabling unprivileged user namespaces, though the latter may break rootless containers and sandboxed browsers. The fix was merged on June 16, 2026, after being posted to the netdev mailing list weeks earlier.