CVE-2026-46331: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-46331 is a Linux kernel vulnerability dubbed "pedit COW" (also referred to as "DirtyClone" in some community coverage) affecting the traffic control (tc) act_pedit module (net/sched). The flaw causes partial copy-on-write (COW) failure leading to kernel page cache corruption, enabling local privilege escalation to root. It was published on June 16, 2026, and affects Linux kernel versions from 4.19.244 through 6.18.x (before 6.12.94, 6.18.36, 7.0.13) and is fixed in kernel 7.1. It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Feedly).

The root cause lies in tcf_pedit_act(), which pre-computes the COW range for skb_ensure_writable() once before the per-key loop using tcfp_off_max_hint. This hint does not account for the runtime header offset added by typed keys, leaving portions of the write region un-COW'd — meaning the kernel may write directly into shared page cache pages rather than private copies. This constitutes an out-of-bounds write (CWE-787) combined with integer overflow/wraparound in offset arithmetic (CWE-190). The fix moves skb_ensure_writable() inside the per-key loop, adds overflow checking on offset arithmetic, uses skb_cow() for negative offsets (e.g., Ethernet header edits at ingress), and guards offset_valid() against INT_MIN where negation is undefined. Exploitation requires a local user with the ability to configure network traffic control rules — achievable via a user namespace with CAP_NET_ADMIN on most default Linux configurations (GitHub Advisory, Feedly).

Successful exploitation allows an unprivileged local attacker to corrupt kernel page cache memory, enabling full privilege escalation to root. The public exploit (packet_edit_meme) demonstrates this by using a user namespace CAP_NET_ADMIN child process to overwrite the cached ELF entry point of a setuid-root binary (e.g., /bin/su) with shellcode, achieving root on RHEL 10.0, Debian 13, and Ubuntu 24.04.4. All three CIA pillars are affected: confidentiality (full system data access as root), integrity (arbitrary kernel/filesystem modification), and availability (system crash or denial of service) (Feedly, GitHub Advisory).

A complete, functional public exploit (packet_edit_meme) is available on GitHub and has been verified to achieve unprivileged local root on multiple major Linux distributions (PoC GitHub). A detailed write-up is also publicly available (blindthoughts.com). The EPSS score is approximately 0.14–0.26%, though the availability of a working exploit significantly elevates practical risk. The NVD SSVC assessment classifies exploitation status as "PoC" with "total" technical impact. No specific threat actor attribution or CISA KEV catalog listing has been identified at this time, but the vulnerability received broad media coverage and community attention within 24 hours of the PoC's release (GitHub Advisory, The Hacker News).

1. Gain local access: Obtain a local shell on a vulnerable Linux system (kernel 4.19.244–6.18.x before patched versions) as any unprivileged user.
2. Create a user namespace: Spawn a child process in a new user namespace to obtain CAP_NET_ADMIN capability without requiring real root privileges — this is permitted by default on most Linux distributions.
3. Configure malicious tc pedit rules: Using the CAP_NET_ADMIN capability within the user namespace, configure traffic control (tc) rules using the act_pedit action with typed keys that include a runtime header offset, causing the pre-computed COW range to be insufficient.
4. Trigger page cache corruption: Send crafted packets through the tc pipeline to trigger tcf_pedit_act(). Due to the partial COW bug, the kernel writes directly into shared page cache pages rather than private copies, corrupting cached file data.
5. Overwrite setuid binary in page cache: Target the cached ELF entry point of a setuid-root binary such as /bin/su and overwrite it with attacker-controlled shellcode using the packet_edit_meme.c exploit primitive (pedit_primitive.c).
6. Execute shellcode as root: Invoke the targeted setuid binary (e.g., /bin/su). The kernel executes the attacker's shellcode from the corrupted page cache with root privileges, yielding a root shell (PoC GitHub, blindthoughts.com).

• Process: Unexpected child processes spawned from a user namespace with CAP_NET_ADMIN; tc (traffic control) commands executed by non-root users; sudden privilege escalation of a process from unprivileged UID to UID 0; /bin/su or other setuid binaries spawning shells without user interaction.
• Network/Kernel: Unusual tc filter or tc action rules added to network interfaces by non-root users; kernel log messages related to act_pedit or skb_ensure_writable errors in dmesg.
• File System: Unexpected modification timestamps on setuid binaries (e.g., /bin/su, /usr/bin/sudo) without corresponding package updates; page cache inconsistencies detectable via file integrity monitoring tools (e.g., AIDE, Tripwire).
• Logs: Audit log entries (auditd) showing unshare or clone syscalls with CLONE_NEWUSER/CLONE_NEWNET flags followed by tc commands from the same process tree; execve of setuid binaries immediately followed by root-level activity from a previously unprivileged session.
• KQL/Detection: A community-contributed KQL Advanced Hunting query for detecting this exploit is available at GitHub KQL Detection.

Patch: Update the Linux kernel to a fixed version — 6.12.94, 6.18.36, 7.0.13, or 7.1+. Red Hat has issued multiple errata (e.g., RHSA-2026:27288, RHSA-2026:27354, RHSA-2026:27355, RHSA-2026:33220–33225, RHSA-2026:29794, RHSA-2026:29799, RHSA-2026:29833) for RHEL 8, 9, and 10 (Red Hat Errata). Debian has accepted the fix in linux 7.0.13-1 (Debian Tracker). Workarounds: Restrict access to tc (traffic control) configuration commands to trusted users only; consider disabling user namespaces (sysctl -w kernel.unprivileged_userns_clone=0) if not required, which removes the CAP_NET_ADMIN escalation path used by the public exploit; disable the act_pedit kernel module if packet editing is not needed (modprobe -r act_pedit). CloudLinux has published specific mitigation guidance (CloudLinux Blog).

The vulnerability received significant media and community attention within 24 hours of the public PoC release. The Hacker News covered it under the headline "New Linux Pedit COW Exploit Enables Root Access by Poisoning Cached Binaries" (The Hacker News), and SC World reported on it alongside a related flaw (CVE-2026-43503, "DirtyClone") (SC World). The exploit was discussed extensively on Reddit (r/ExploitDev, r/cybersecurity, r/pwnhub) and Hacker News, with community members noting its similarity to the original Dirty COW vulnerability. CloudLinux published a dedicated mitigation blog post (CloudLinux Blog), and a community KQL detection rule was contributed to GitHub. The Hong Kong GovCERT issued an alert (GovCERT HK), and Microsoft's MSRC also tracked the CVE.