Linux CVE-2026-46331 Explained: Pedit COW Vulnerability Grants Root Access

A Linux kernel vulnerability, tracked as CVE-2026-46331 and nicknamed “Pedit COW,” has raised serious concerns among cybersecurity professionals. The flaw allows a local, unprivileged user to gain root-level access on vulnerable Linux systems by exploiting a weakness in the kernel’s traffic-control subsystem.

What makes this vulnerability particularly dangerous is that attackers can achieve full system compromise without modifying the actual files stored on disk. Instead, the exploit targets the system’s memory cache, making traditional file-integrity checks ineffective.

CVE-2026-46331 is an out-of-bounds write vulnerability found in the Linux kernel’s packet-editing action, known as act_pedit. The flaw exists within the traffic-control (tc) subsystem, which is used for managing and modifying network traffic.

Security researchers discovered that under specific conditions, the vulnerability allows an attacker to overwrite data in shared page-cache memory. This memory corruption can then be used to alter the in-memory version of privileged system binaries such as /bin/su, ultimately enabling an attacker to launch a root shell.

A public proof-of-concept (PoC) exploit was released within a day of the CVE being assigned on June 16, significantly increasing the risk for unpatched systems. Due to the severity of the issue, Red Hat has classified the vulnerability as Important.

The Linux traffic-control utility includes a feature called pedit, which allows administrators to modify packet headers as network traffic passes through the system.

The vulnerability originates in a kernel function called tcf_pedit_act(). Under normal circumstances, the function should create a private copy of data before making any modifications. This process follows the standard copy-on-write (COW) mechanism, which prevents changes from affecting shared memory.

However, researchers found that the function validates writable memory ranges before the final packet offsets are fully determined. Some packet-editing keys calculate their offsets only during runtime. As a result, writes can occur outside the intended memory region.

Instead of modifying a private copy, the kernel ends up altering a shared page-cache page. If that page belongs to a cached executable file, the file’s in-memory image becomes corrupted.

Attackers can exploit this behavior to inject malicious code into the cached version of a privileged executable. When the altered executable is launched, it runs with root privileges, giving the attacker complete control over the system.

The attack pattern seen in Pedit COW resembles several high-profile Linux kernel vulnerabilities discovered in recent years.

These include:

• Dirty Pipe
• Copy Fail
• DirtyClone
• Dirty Frag

All of these vulnerabilities share a common characteristic: a kernel operation writes data into memory pages that are not exclusively owned by the process performing the write.

The major difference with Pedit COW is its entry point. By using user namespaces, an unprivileged user can obtain the namespace-local CAP_NET_ADMIN capability required to trigger the vulnerable functionality.

Researchers successfully demonstrated the exploit on multiple Linux distributions.

The proof-of-concept exploit successfully achieved privilege escalation on RHEL 10. Red Hat has also identified RHEL 8 and RHEL 9 as affected versions.

Testing confirmed successful exploitation on Debian 13 (Trixie). Debian has already released fixes for Trixie through its security update channel. However, Debian 11 and Debian 12 remain listed as vulnerable.

Ubuntu systems are also affected by the underlying kernel flaw.

Researchers reported that Ubuntu 24.04 could be exploited through AppArmor configurations that still allow unprivileged user namespaces.

While Ubuntu 26.04 restricts this attack path by default through tighter AppArmor policies, the vulnerable kernel code still exists, meaning systems should still be patched.

As of June 25, Ubuntu lists supported releases from 18.04 through 26.04 as vulnerable.

The attack requires two key conditions:

1. The act_pedit module must be available and loadable.
2. Unprivileged user namespaces must be enabled.

When both conditions are present, attackers can gain the namespace-local CAP_NET_ADMIN privilege necessary to trigger the vulnerability.

Many Linux distributions enable these features by default, making exploitation possible without administrative permissions.