ctipilot.ch

Linux kernel 'pedit COW' LPE — tc act_pedit out-of-bounds write poisons setuid-binary page cache; public weaponised PoC

cve · CVE-2026-46331

Coverage timeline
2
first 2026-06-27 → last 2026-06-29
Peak priority
notable
2 notable
Sources cited
3
3 hosts
Sections touched
2
trending-vulnerabilities, weekly-vuln-rollup
Co-occurring entities
0
no co-occurrence
ATT&CK techniques
0
no mapped behavior yet

Hunting pivots

Tags
lpe ×2patch-available ×2poc-public ×2priv-esc ×2vulnerabilities ×2

Story timeline

  1. 2026-06-29CVE-2026-43503 (DirtyClone) and CVE-2026-46331 (pedit COW) — Linux kernel LPE with public weaponised PoCs
    weekly-vuln-rollup
  2. 2026-06-27CVE-2026-46331 — Linux kernel "pedit COW": out-of-bounds write in the tc act_pedit module (public weaponised PoC)
    trending-vulnerabilities

Where this entity is cited

  • trending-vulnerabilities1
  • weekly-vuln-rollup1

Source distribution

  • access.redhat.com1 (33%)
  • research.jfrog.com1 (33%)
  • thehackernews.com1 (33%)

explore in graph

External references

NVD · cve.org · CISA KEV

All cited sources (3)

Entries about Linux kernel 'pedit COW' LPE — tc act_pedit out-of-bounds write poisons setuid-binary page cache; public weaponised PoC (2)

2026-06-29 · view entry permalink →

NOTABLECVE-2026-43503 +1

CVE-2026-43503 (DirtyClone) and CVE-2026-46331 (pedit COW) — Linux kernel LPE with public weaponised PoCs

Two page-cache-corruption local-privilege-escalation flaws drew working exploits within the window. JFrog published a full DirtyClone walkthrough (XFRM/IPsec skb cloning) on 06-25; a companion tc act_pedit out-of-bounds write (pedit COW) gained a weaponised PoC within a day of assignment. Both are post-auth root escalation on patched-but-unrebooted hosts — prioritise kernel updates on multi-tenant and internet-exposed Linux where an initial foothold is plausible.

vulnerability29 Jun 00:21Zmulti-sourceOpen finding ↗
Sources: JFrog Security Research · Red Hat RHSB-2026-008 · The Hacker News — pedit COW

2026-06-27 · view entry permalink →

NOTABLECVE-2026-46331

CVE-2026-46331 — Linux kernel "pedit COW": out-of-bounds write in the tc act_pedit module (public weaponised PoC)

A separate page-cache-corruption LPE, pedit COW, drew a public weaponised PoC (packet_edit_meme) within a day of CVE assignment on 2026-06-16 (Red Hat Product Security, 2026-06-19). The bug is a missing bounds check in tcf_pedit_act() in net/sched/act_pedit.c: the function computes the copy-on-write range once before iterating the key list, so writes from later typed keys (whose runtime header offsets are not accounted for) fall outside the private copy and into read-only file-backed page-cache memory — a partial COW. An unprivileged user with tc rule-write access (again, obtainable through user namespaces) overwrites the cached /bin/su to spawn a root shell (The Hacker News, 2026-06-26). Red Hat confirms RHEL 8/9/10, RHCOS (OpenShift) and RHOSP affected; the flaw is exposed since kernel v5.18 and fixed upstream in v7.1-rc7. Interim mitigation where tc pedit is unused: blacklist the act_pedit module, or set kernel.unprivileged_userns_clone=0.

vulnerability27 Jun 05:17Zmulti-sourceOpen finding ↗
Sources: Red Hat RHSB-2026-008 · The Hacker News