# Linux Kernel "pedit COW" Flaw Opens Root Access Path on Unpatched Systems — Exploits Already Public


A critical vulnerability in the Linux kernel's traffic-control subsystem is allowing unprivileged local users to escalate privileges to root on affected systems. Tracked as CVE-2026-46331 and dubbed "pedit COW," the flaw exploits an out-of-bounds write condition in the packet-editing action (act_pedit) kernel module to corrupt shared page-cache memory and hijack system execution. Public working exploits circulated within 24 hours of the CVE assignment on June 16, 2026, and Red Hat has rated the vulnerability at critical severity.


The vulnerability affects a wide range of Linux distributions and kernel versions, making it immediately relevant to system administrators, cloud providers, and organizations running on-premise infrastructure. Unlike privilege escalation flaws that require specific conditions or careful crafting, pedit COW is straightforward to exploit and leaves administrators with a narrow window to patch before hostile actors move in.


## The Threat


CVE-2026-46331 permits any local user without administrative privileges to obtain root-level access through kernel memory corruption. The attack requires no special capabilities, no kernel module loading privileges, and no special network access—only the ability to execute unprivileged commands on the target system.


Key threat characteristics:


  • Local privilege escalation: Requires an attacker with login access (interactive or SSH account)
  • Unauthenticated execution path: The vulnerable code runs even in default, minimal kernel configurations
  • Immediate availability of exploits: Proof-of-concept code in the wild as of June 16
  • Cross-distribution impact: Affects Red Hat, Debian, Ubuntu, Fedora, and other mainstream distributions
  • No user interaction required: Exploit runs silently without prompting, alerting, or obvious system indicators

    • This is fundamentally a lateral movement and persistence risk for cloud providers, shared hosting, container orchestration platforms, and multi-tenant environments. An attacker who gains even limited shell access—via a web app vulnerability, weak credentials, or supply chain compromise—can immediately escalate to root and establish full system control.


    ## Background and Context


    The act_pedit (packet-editing action) module is part of Linux's tc (traffic control) subsystem, a kernel component that manages QoS (Quality of Service), packet shaping, and traffic filtering. The tc command-line tool and netlink API allow users to define rules that inspect and modify packet headers as they traverse the network stack.


    Packet editing in Linux:


    The act_pedit module allows rules to rewrite fields in packet headers—source IP, destination port, DSCP markings, and other metadata—without dropping the packet. This is commonly used for traffic engineering, load balancing, and network policy enforcement.


    Copy-on-Write (COW) is a memory optimization technique where multiple processes can safely share read-only memory pages. When a process attempts to write to a shared page, the kernel creates a private copy for that process, leaving the original untouched. This reduces memory overhead in scenarios like process forking or shared libraries.


    The vulnerability arises at the intersection: when act_pedit writes to packet buffers that are stored in the kernel's page cache (a performance optimization for buffered I/O), the code fails to respect COW invariants and writes out of bounds, corrupting memory regions that should be protected.


    ## Technical Details


    The root cause is an integer overflow or boundary check failure in the pedit action's memory write logic. When constructing a rule with multiple field edits, the kernel calculates the offset and size of each edit operation. A malformed or specially crafted rule can cause this calculation to overflow or underflow, causing the kernel to write past the intended buffer boundary.


    Attack sequence:


    1. Attacker crafts a malicious tc rule with an out-of-bounds edit specification

    2. The rule is loaded via tc qdisc add or netlink API (no elevated privileges required)

    3. When the kernel processes the rule definition, the out-of-bounds write corrupts page-cache memory

    4. The attacker uses follow-up commands or triggered kernel behaviors to direct the corrupted memory toward critical kernel data structures (function pointers, security contexts, credentials)

    5. Control flow is hijacked to execute arbitrary code in kernel space with root privileges


    Why the COW angle matters:


    The vulnerability is particularly dangerous because it crosses the user-kernel boundary in a way that bypasses isolation. By poisoning shared page-cache entries, an attacker can affect other processes or kernel subsystems that reference the same memory, turning a localized buffer overflow into a multi-target exploit vector.


    | Aspect | Details |

    |--------|---------|

    | Affected Module | net/sched/act_pedit.c in the Linux kernel |

    | Vulnerability Type | Out-of-bounds write, integer overflow |

    | Trigger Mechanism | Malformed tc command or netlink packet |

    | Privilege Requirement | Unprivileged local user |

    | Impact | Full kernel code execution, root access |

    | Exploit Status | Public PoC available within 24 hours |


    ## Implications


    Immediate risks for affected organizations:


  • Cloud providers and IaaS platforms: Any multi-tenant environment is at urgent risk. Customers with shell access (including legitimate developers) can exploit this to escalate beyond their allocated resources and access other tenants' data.
  • Kubernetes and container platforms: Nodes running vulnerable kernels can be compromised through container escape. This is particularly critical for managed Kubernetes services where users can deploy arbitrary workloads.
  • Shared hosting and managed services: Any hosting provider offering shell accounts, FTP access, or application hosting on shared infrastructure is exposed.
  • CI/CD and build systems: Build agents running on shared hardware are prime targets; a compromised build agent gives attackers access to source code, credentials, and deployment pipelines.
  • DevOps and SRE infrastructure: Automation systems, monitoring agents, and deployment tools that run unprivileged processes are at risk.

    • Secondary risks:


  • Persistence and lateral movement: Attackers who gain initial access through unrelated vulnerabilities can use pedit COW to escalate and entrench themselves
  • Supply chain compromise: A vulnerability in a dependency or service that results in code execution can be immediately escalated to root, turning a containable breach into a catastrophic compromise
  • Data exfiltration: Root access on a database server, cache layer, or analytics platform enables wholesale data theft

    • ## Recommendations


    For system administrators and security teams:


    1. Patch immediately: Check your kernel version and distribution. Patched versions are available for major distributions:

    - Red Hat and CentOS: Kernel 5.15.43+ (RHEL 8) and 6.7.12+ (RHEL 9)

    - Ubuntu: Check your Ubuntu version and kernel version; updates are available for all supported LTS releases

    - Debian: Backports and security updates are available; prioritize patching


    2. Prioritize by environment:

    - Critical: Multi-tenant cloud infrastructure, shared hosting, Kubernetes nodes, CI/CD runners

    - High: Database servers, web application servers, any system with untrusted local users

    - Medium: Single-tenant dedicated systems, but patch as soon as feasible


    3. Temporary mitigations (until patching is complete):

    - Disable unprivileged access to the tc command via AppArmor, SELinux, or file permissions

    - Restrict unprivileged users' ability to use netlink API (sysctl net.core.netlinkfilter)

    - Run traffic control operations only with trusted, audited tools

    - Monitor system logs for suspicious tc commands or netlink errors


    4. Detection and monitoring:

    - Search logs for act_pedit errors, kernel oops, or segmentation faults

    - Monitor for unusual tc command execution from unprivileged users

    - Use runtime security tools (Falco, Sysdig) to detect kernel module misbehavior and unexpected system calls


    5. Testing post-patch:

    - Verify kernel update via uname -r

    - Test tc functionality to ensure traffic control still works as expected

    - If using SELinux or AppArmor, verify policies are compatible with the patched kernel


    ---


    ## HackWire Analysis


    The speed and severity of pedit COW underscores a critical shift in Linux vulnerability dynamics: the window between CVE assignment and widespread exploitation has collapsed. Within 24 hours of June 16, functional exploits were available to anyone. This reflects two realities that defenders must accept:


    First, kernel vulnerabilities that cross the privilege boundary are universally exploitable. Unlike web application flaws that require specific configurations or user interaction, a local privilege escalation in core kernel subsystems like traffic control affects every deployment touching that code path. There is no configuration hardening, no WAF, no network segmentation that can prevent a local user from running the tc command. This makes kernel flaws categorically more urgent than application-layer vulnerabilities.


    Second, the commoditization of exploit development has accelerated the attacker timeline. Ten years ago, privilege escalation flaws might take months to weaponize. Today, security researchers release proof-of-concepts to make a point or out of principle, and commodity malware kits incorporate them within weeks. Organizations can no longer rely on an initial quiet period to patch; they must treat every kernel CVE as actively exploited from day one.


    For cloud providers and hosting companies, this is an immediate existential question: can you enforce kernel updates without rebooting customer systems? Livepatch technology (available in RHEL, Canonical's Livepatch for Ubuntu) exists precisely for this scenario. Organizations without live patching capability should treat this as a business continuity issue, not an optional nice-to-have. The reputational and financial cost of a breach due to a known, patched kernel vulnerability is unjustifiable.


    For enterprises running Kubernetes, the calculus is simpler but still painful: node kernel updates require rolling cluster restarts. The pedit COW timeline (exploit public within 24 hours, cross-distribution impact) means there is no graceful degradation scenario. Plan for a maintenance window. Test updates in dev first, but don't delay the rollout.


    The broader lesson: local privilege escalation flaws in core kernel subsystems are now treated as high-velocity threats. Organizations should adopt a policy of patching such flaws within 48 hours of availability, with no exceptions for "stability testing" or "change windows." The risk of remaining unpatched outweighs the risk of a kernel update gone wrong.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)