Security News New Linux pedit COW Exploit Enables Root Access by Poisoning Cached Binaries

Captain Awesome

Captain Awesome

Level 27
Thread author
Verified
Top Poster
Well-known
Forum Veteran
May 7, 2016
1,696
11,718
2,569
India
Content source
https://thehackernews.com/2026/06/new-linux-pedit-cow-exploit-enables.html?m=1
A flaw in the Linux kernel's traffic-control subsystem can let a local unprivileged user gain root on affected systems.

CVE-2026-46331, nicknamed "pedit COW," is an out-of-bounds write in the packet-editing action (act_pedit) that corrupts shared page-cache memory. A public, working exploit appeared within a day of the CVE assignment on June 16. Red Hat rates the flaw as important.

The exploit never touches the file on disk. It poisons the cached copy of a setuid root binary (/bin/su) in memory, injects a small payload, and runs that altered image as root. File-integrity checks come back clean while a root shell is already open.

The exploit needs two things: act_pedit being loadable and unprivileged user namespaces being open, giving the attacker a namespace-local networking capability (CAP_NET_ADMIN) needed to trigger the bug.
Click to expand...
 
  • Thanks
  • Like
Reactions: simmerskool, Victor M and 7Oz-64
To protect your systems from this vulnerability, implement the following security measures immediately:1. Apply Official Kernel PatchesThe most effective and permanent solution is to update your Linux kernel to a patched version and reboot the system.Debian: Update systems running Debian 13 (trixie), where fixes have already been deployed. Keep a close eye on security channels for Debian 11 and 12 updates.
Ubuntu / Red Hat: Check your respective package managers (apt or dnf) for the latest kernel security updates addressing CVE-2026-46331 for RHEL 8/9/10 and Ubuntu 18.04 through 26.04.Priority: Prioritize multi-tenant environments, CI/CD runners, Kubernetes nodes, and shared build or research servers where untrusted users have local access.
2.Disable the Affected Kernel ModuleIf you cannot immediately reboot or patch the system, you can break the exploit chain by blocking the vulnerable act_pedit traffic-control module from loading.
 
  • Like
  • Thanks
Reactions: Victor M and 7Oz-64
Victor M said:
Doesn't seem to affect Fedora KDE ? Doesn't seem to have this act_pedit .
Click to expand...
If you checked your active modules via lsmod and did not see act_pedit,Fedora KDE system could still be vulnerable.
You can verify if the module is built into your system by checking your kernel configuration file directly rather than looking at active modules. Run this command:
grep CONFIG_NET_ACT_PEDIT /boot/config-$(uname -r)
Click to expand...
If it returns =m: Your system is vulnerable. The module is sitting on your disk ready to be silently auto-loaded by an exploit script.
If it returns # CONFIG_NET_ACT_PEDIT is not set: Your system is safe. The code literally does not exist in your kernel.
 
  • Hundred Points
  • Like
Reactions: 7Oz-64 and simmerskool
This may be a dumb question but I will ask anyway. I have been dual booting Linux Mint 22.2 with Windows 11. When I read about this Linux flaw I ran the grep command in Mint mentioned above, many thanks to @Captain Awesome for posting it. I got the =m result. After that I went into Firefox and Chrome in MInt and signed out of all websites and deleted my browsing history from both browsers and deleted Chrome from Mint. Then I deleted my Mint partition and used the Windows terminal with Admin command prompt to delete grub. My question is, does this Linux flaw affect Windows too? A quick scan with Windows Security did not find any problems. Thanks for any info on this.

C.H.
 
  • Like
Reactions: 7Oz-64 and simmerskool
Victor M said:
Doesn't seem to affect Fedora KDE ? Doesn't seem to have this act_pedit .
Click to expand...
and (fwiw) chatGPT tells me this was issue related to kernel 7.0.9 and RH / fedora has fixed it ages ago -- that is, my notes show I was running 7.0.9 kernel 31 May but been updating fedora kinoite once or twice a week and now running 7.0.13. Plus chatGPT says this is less a concern for me given x y z... good info to know but panic not necessary. (disclaimer chatGPT can make mistakes, and I am just a user not an expert)
 
  • Like
Reactions: Captain Awesome and 7Oz-64
Captain Holly said:
This may be a dumb question but I will ask anyway. I have been dual booting Linux Mint 22.2 with Windows 11. When I read about this Linux flaw I ran the grep command in Mint mentioned above, many thanks to @Captain Awesome for posting it. I got the =m result. After that I went into Firefox and Chrome in MInt and signed out of all websites and deleted my browsing history from both browsers and deleted Chrome from Mint. Then I deleted my Mint partition and used the Windows terminal with Admin command prompt to delete grub. My question is, does this Linux flaw affect Windows too? A quick scan with Windows Security did not find any problems. Thanks for any info on this.

C.H.
Click to expand...
No question is ever dumb when it comes to security.
No, this Linux flaw does not affect Windows 11.
Because you deleted the Linux partition and the GRUB bootloader, any potential risk from that Linux environment is completely gone. Windows operates on an entirely different architecture and is unaffected by this specific vulnerability.
 
Captain Awesome said:
No question is ever dumb when it comes to security.
No, this Linux flaw does not affect Windows 11.
Because you deleted the Linux partition and the GRUB bootloader, any potential risk from that Linux environment is completely gone. Windows operates on an entirely different architecture and is unaffected by this specific vulnerability.
Click to expand...
Thanks for the info. I was pretty sure Windows would be safe from any problems in Linux but you can't be too careful nowadays with security. I have always had an on again-off again relationship with Linux anyway and security and the lack of any kind of antivirus or antimalware was my biggest concern with it. I never had any trouble with Mint itself but am not so sure I will use it again. Thanks for your help on this.

C.H.
 

You may also like...