New Linux pedit COW Exploit Enables Root Access by Poisoning Cached Binaries

A recently discovered vulnerability in the Linux kernel's traffic-control subsystem, designated as CVE-2026-46331 and referred to as "pedit COW," poses a significant risk by allowing local unprivileged users to gain root access on affected systems. This flaw, which was publicly disclosed shortly after its assignment on June 16, enables attackers to exploit shared page-cache memory through an out-of-bounds write in the packet-editing action known as act_pedit.

Technical Analysis

The pedit COW vulnerability stems from a flaw in the Linux kernel's handling of packet editing operations. Specifically, the kernel function tcf_pedit_act() is intended to create a private copy of data before any modifications are made. However, the vulnerability arises when the writable range is checked prematurely, allowing an attacker to write outside this range. This results in the corruption of shared page-cache memory, rather than a private copy, leading to the potential for privilege escalation.

Attackers can leverage this vulnerability by injecting a payload into the cached memory of a setuid root binary, such as /bin/su, allowing them to execute this altered binary with root privileges. Notably, this exploit does not alter the on-disk file, which means traditional file-integrity checks may not detect any anomalies.

Affected Systems

  • Red Hat Enterprise Linux 10
  • Debian 13 (Trixie)
  • Ubuntu 24.04 (with specific AppArmor configurations)
  • Ubuntu 26.04 (though user namespaces are restricted)

In particular, systems that allow unprivileged user namespaces and have the act_pedit action loadable are at heightened risk.

Attack Method / Threat Activity

The exploitation of CVE-2026-46331 requires two main conditions: the ability to load the act_pedit action and the presence of unprivileged user namespaces. This combination grants attackers the necessary networking capabilities (CAP_NET_ADMIN) to trigger the vulnerability. The attack process typically involves:

  1. Configuring the tc tool to set up packet-editing actions.
  2. Triggering the out-of-bounds write to corrupt the shared page-cache memory.
  3. Executing the modified setuid binary to gain root access.

    📬 Stay ahead of the threat

    Get the latest SOC guides, threat intel, and detection engineering — straight to your inbox.

Detection Opportunities

To detect potential exploitation of this vulnerability, security teams should consider the following:

  • Monitor for unusual activity related to the tc tool, especially configurations involving act_pedit.
  • Implement SIEM solutions to alert on anomalous access patterns to setuid binaries.
  • Utilize threat-hunting techniques to identify any unauthorized modifications in shared memory areas.

Mitigation Recommendations

To mitigate the risks associated with the pedit COW vulnerability, organizations should take immediate action:

  • Install the latest kernel patches provided by your Linux distribution and reboot systems to apply these updates.
  • Prioritize patching on systems where local users may not be trusted, such as multi-tenant environments, CI/CD runners, and shared lab machines.
  • Consider disabling unprivileged user namespaces if they are not required for your operations.

Business Impact

The potential for unprivileged users to gain root access through this vulnerability can have severe implications for organizations. Successful exploitation can lead to:

  • Compromise of sensitive data and systems.
  • Disruption of services and operational integrity.
  • Increased attack surface for further exploitation or lateral movement within the network.

Given the ease of exploitation and the rapid emergence of public proof-of-concept exploits, organizations must act swiftly to protect their environments.

Final Summary

The discovery of the pedit COW vulnerability highlights a critical weakness in the Linux kernel that can be exploited by local unprivileged users to gain root access. With a public exploit already in circulation, it is imperative for security teams to prioritize patching and implement robust detection measures. By understanding the technical details and potential impacts of this vulnerability, organizations can better safeguard their systems against emerging threats.