CVE-2026-46331

Published Jun 16, 2026

Last updated a month ago

Cloud

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-46331, dubbed "pedit COW," is a local privilege escalation vulnerability found within the Linux kernel's traffic-control subsystem, specifically affecting the `act_pedit` packet-editing action. The flaw stems from a "partial Copy-on-Write (COW)" failure where the `tcf_pedit_act()` function incorrectly calculates the writable range. It computes this range before accounting for runtime header offsets introduced by typed keys, leading to an out-of-bounds write that corrupts shared page-cache memory. Exploitation of this vulnerability allows a local unprivileged user to gain root access on affected systems. Attackers can achieve this by poisoning the cached copy of a setuid root binary, such as `/bin/su`, in memory. They inject a malicious payload into this cached image, which then executes with root privileges when the binary is invoked, all while leaving the on-disk file integrity checks undisturbed. Successful exploitation typically requires `act_pedit` to be loadable and unprivileged user namespaces to be enabled, granting the necessary `CAP_NET_ADMIN` capability.

Description: In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
NVD status: Modified
Products: linux_kernel

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.8
Impact score: 5.9
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-190
0b0ca135-0b70-47e7-9f44-1890c2a1c46c: CWE-787

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "5462027E-2B1C-458C-A3A0-D52D1266CB05",
            "versionEndExcluding": "4.20",
            "versionStartIncluding": "4.19.244",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "1C90F23C-53C6-41F9-9D7B-AA0786FE9EF1",
            "versionEndExcluding": "5.5",
            "versionStartIncluding": "5.4.195",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "2E007EBD-7427-43F5-8841-92948E4D8F2E",
            "versionEndExcluding": "5.11",
            "versionStartIncluding": "5.10.117",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "1BD800FC-C1D4-4E6E-BD2F-5A56BF76E9D6",
            "versionEndExcluding": "5.16",
            "versionStartIncluding": "5.15.41",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "237FF665-63EB-4FB8-B2DC-5BD5D79B8053",
            "versionEndExcluding": "5.18",
            "versionStartIncluding": "5.17.9",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "E3BD3A9E-B1D7-4325-A0EB-31A1169EF6A7",
            "versionEndExcluding": "6.12.94",
            "versionStartIncluding": "5.18.1",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "389025D2-958D-41BD-BD96-70ED1033A9F3",
            "versionEndExcluding": "6.18.36",
            "versionStartIncluding": "6.13",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "6A64BF9F-3BCA-42FD-98CB-8F03474D2B1E",
            "versionEndExcluding": "7.0.13",
            "versionStartIncluding": "6.19",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:5.18:-:*:*:*:*:*:*",
            "matchCriteriaId": "0384FA0A-DE99-48D7-84E3-46ED0C3B5E03",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:5.18:rc7:*:*:*:*:*:*",
            "matchCriteriaId": "2FCFCE58-5118-4D05-864E-C82CF20EABE5",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
            "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
            "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*",
            "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*",
            "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*",
            "matchCriteriaId": "81DFF19E-9CF8-49C6-8C36-1E4038622933",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:*",
            "matchCriteriaId": "B0E8FC71-3952-444C-83E9-718DBBBEC615",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.