CVE-2026-46331: Linux Kernel act_pedit — Stealth Root Escalation via COW (June 2026)

CVE-2026-46331 — Linux Kernel act_pedit

CVE-2026-46331 is a critical local privilege escalation vulnerability in the Linux kernel's traffic-control subsystem, specifically within the act_pedit packet-editing action. It allows unprivileged local users to gain root access by corrupting cached copies of setuid root binaries in memory, without modifying files on disk. No public exploitation has been confirmed yet, but the attack is stealthy and bypasses standard file-integrity monitoring.

Attack Vector

Attackers exploit act_pedit to manipulate the kernel’s page-cache via a copy-on-write (COW) flaw. By targeting setuid root binaries, they poison the in-memory cache, enabling execution of malicious code with root privileges. This does not alter the file on disk, evading traditional integrity checks. The attack requires unprivileged user namespaces to be enabled and the act_pedit kernel module to be loaded. No external network access is needed; the attacker must have local access to the system.

Who Is at Risk

Confirmed affected distributions include Red Hat Enterprise Linux 10, Debian 13, and multiple Ubuntu versions. Any Linux system with unprivileged user namespaces enabled and the act_pedit module loaded is vulnerable. Multi-tenant servers, CI/CD runners, and shared hosting environments are at particularly high risk due to increased likelihood of untrusted local users. Organizations running these distributions should assume exposure until patches are applied.

Patch & Mitigate

• Patch: Apply vendor kernel updates as soon as available for RHEL 10, Debian 13, and Ubuntu. Monitor vendor advisories for hotfix release dates.
• Workaround: Temporarily disable unprivileged user namespaces and unload the act_pedit kernel module if operationally feasible.
• Detect: Monitor for abnormal execution of setuid binaries, unexpected kernel module loads, and unusual memory page activity. Review logs for unauthorized privilege escalation attempts.

MITRE ATT&CK

• TA0004 — Privilege Escalation: Attackers use this flaw to move from unprivileged to root access.
• TA0001 — Initial Access: Exploitation requires local access, often via compromised user accounts or containers.

Source: https://thehackernews.com/2026/06/new-linux-pedit-cow-exploit-enables.html