Security News New Linux pedit COW Exploit Enables Root Access by Poisoning Cached Binaries

[Captain Awesome]

Content source

https://thehackernews.com/2026/06/new-linux-pedit-cow-exploit-enables.html?m=1

A flaw in the Linux kernel's traffic-control subsystem can let a local unprivileged user gain root on affected systems.

CVE-2026-46331, nicknamed "pedit COW," is an out-of-bounds write in the packet-editing action (act_pedit) that corrupts shared page-cache memory. A public, working exploit appeared within a day of the CVE assignment on June 16. Red Hat rates the flaw as important.

The exploit never touches the file on disk. It poisons the cached copy of a setuid root binary (/bin/su) in memory, injects a small payload, and runs that altered image as root. File-integrity checks come back clean while a root shell is already open.

The exploit needs two things: act_pedit being loadable and unprivileged user namespaces being open, giving the attacker a namespace-local networking capability (CAP_NET_ADMIN) needed to trigger the bug.

 

[Captain Awesome]

To protect your systems from this vulnerability, implement the following security measures immediately:1. Apply Official Kernel PatchesThe most effective and permanent solution is to update your Linux kernel to a patched version and reboot the system.Debian: Update systems running Debian 13 (trixie), where fixes have already been deployed. Keep a close eye on security channels for Debian 11 and 12 updates.
Ubuntu / Red Hat: Check your respective package managers (apt or dnf) for the latest kernel security updates addressing CVE-2026-46331 for RHEL 8/9/10 and Ubuntu 18.04 through 26.04.Priority: Prioritize multi-tenant environments, CI/CD runners, Kubernetes nodes, and shared build or research servers where untrusted users have local access.
2.Disable the Affected Kernel ModuleIf you cannot immediately reboot or patch the system, you can break the exploit chain by blocking the vulnerable act_pedit traffic-control module from loading.

 

[Victor M]

Doesn't seem to affect Fedora KDE ? Doesn't seem to have this act_pedit .

 

[Captain Awesome]

Doesn't seem to affect Fedora KDE ? Doesn't seem to have this act_pedit .

If you checked your active modules via lsmod and did not see act_pedit,Fedora KDE system could still be vulnerable.
You can verify if the module is built into your system by checking your kernel configuration file directly rather than looking at active modules. Run this command:

grep CONFIG_NET_ACT_PEDIT /boot/config-$(uname -r)

If it returns =m: Your system is vulnerable. The module is sitting on your disk ready to be silently auto-loaded by an exploit script.
If it returns # CONFIG_NET_ACT_PEDIT is not set: Your system is safe. The code literally does not exist in your kernel.

 

[Captain Holly]

This may be a dumb question but I will ask anyway. I have been dual booting Linux Mint 22.2 with Windows 11. When I read about this Linux flaw I ran the grep command in Mint mentioned above, many thanks to @Captain Awesome for posting it. I got the =m result. After that I went into Firefox and Chrome in MInt and signed out of all websites and deleted my browsing history from both browsers and deleted Chrome from Mint. Then I deleted my Mint partition and used the Windows terminal with Admin command prompt to delete grub. My question is, does this Linux flaw affect Windows too? A quick scan with Windows Security did not find any problems. Thanks for any info on this.

C.H.

 

[7Oz-64]

@Captain Holly
If the command return "=m", you just need to prevent it from auto-loading by run this command :

echo 'install act_pedit /bin/true' | sudo tee /etc/modprobe.d/disable-act_pedit.conf

don't forget to update grub or reboot to take effect.

 

[simmerskool]

Doesn't seem to affect Fedora KDE ? Doesn't seem to have this act_pedit .

and (fwiw) chatGPT tells me this was issue related to kernel 7.0.9 and RH / fedora has fixed it ages ago -- that is, my notes show I was running 7.0.9 kernel 31 May but been updating fedora kinoite once or twice a week and now running 7.0.13. Plus chatGPT says this is less a concern for me given x y z... good info to know but panic not necessary. (disclaimer chatGPT can make mistakes, and I am just a user not an expert)

 

[simmerskool]

@Captain Awesome said:
Run this command:
grep CONFIG_NET_ACT_PEDIT /boot/config-$(uname -r)

No such file or directory -- seems sorta consistent with my previous post above, at least for me -- very good info, ChatGPT was not concerned enough to offer that check.

 

[Captain Awesome]

This may be a dumb question but I will ask anyway. I have been dual booting Linux Mint 22.2 with Windows 11. When I read about this Linux flaw I ran the grep command in Mint mentioned above, many thanks to @Captain Awesome for posting it. I got the =m result. After that I went into Firefox and Chrome in MInt and signed out of all websites and deleted my browsing history from both browsers and deleted Chrome from Mint. Then I deleted my Mint partition and used the Windows terminal with Admin command prompt to delete grub. My question is, does this Linux flaw affect Windows too? A quick scan with Windows Security did not find any problems. Thanks for any info on this.

C.H.

No question is ever dumb when it comes to security.
No, this Linux flaw does not affect Windows 11.
Because you deleted the Linux partition and the GRUB bootloader, any potential risk from that Linux environment is completely gone. Windows operates on an entirely different architecture and is unaffected by this specific vulnerability.

 

[Captain Holly]

No question is ever dumb when it comes to security.
No, this Linux flaw does not affect Windows 11.
Because you deleted the Linux partition and the GRUB bootloader, any potential risk from that Linux environment is completely gone. Windows operates on an entirely different architecture and is unaffected by this specific vulnerability.

Thanks for the info. I was pretty sure Windows would be safe from any problems in Linux but you can't be too careful nowadays with security. I have always had an on again-off again relationship with Linux anyway and security and the lack of any kind of antivirus or antimalware was my biggest concern with it. I never had any trouble with Mint itself but am not so sure I will use it again. Thanks for your help on this.

C.H.

 

[Captain Awesome]

Thanks for the info. I was pretty sure Windows would be safe from any problems in Linux but you can't be too careful nowadays with security. I have always had an on again-off again relationship with Linux anyway and security and the lack of any kind of antivirus or antimalware was my biggest concern with it. I never had any trouble with Mint itself but am not so sure I will use it again. Thanks for your help on this.

C.H.

There is Clam AV, Fail2ban,GuFW and Opensnitch, Rootkit detector like chkrootkit available for linux.

 

[Captain Holly]

@Captain Holly
If the command return "=m", you just need to prevent it from auto-loading by run this command :

echo 'install act_pedit /bin/true' | sudo tee /etc/modprobe.d/disable-act_pedit.conf

don't forget to update grub or reboot to take effect.

Thanks for the info on the auto load block command. I finally got around to reinstalling Mint today. I ran the block command and updated grub, also restarted for good measure. I am on the newest 7.0.0-28 kernel too. I still see the =m result when I run grep CONFIG_NET_ACT_PEDIT /boot/config-$(uname -r) but I am not going to worry about it. Everything I can find about this says the problem was corrected with the new kernel. There is nothing about it in the Mint Forum either. I figure if it was that big of a problem it would be all over the forum. Mint is working fine here.

C.H.

 

[Captain Holly]

I spoke too soon here. My dual boot Mint worked fine when I set it up earlier today but when I tried using my laptop tonight it was stuck in what looks like a grub loop. Neither Windows nor Mint would boot up. Trying to go through the boot manager just sent me back to the grub screen again and grub was asking for a login that I don't have and never created. I think this might be an error from when I ran a few terminal commands to try blocking that pedit cow problem. I really had no idea what I was doing. I tried everything I could think of but nothing has worked so I am recovering Windows with the USB I created when I first bought my laptop. So far it is going through all the right screens and processes and when it's done I should be back to Windows with no Mint or grub. After that I think I will just leave well enough alone and stay on Windows. Mint did work great earlier today though, I can say that for sure.

C.H.

 

[Victor M]

echo 'install act_pedit /bin/true' | sudo tee /etc/modprobe.d/disable-act_pedit.conf

Shouldn't that read /bin/FALSE ??

Also @Captain Holly , Mint hasn't shipped the fix as far as ChatGPT knows. Mint seems to be based off Ubuntu 22. The password that shouldn't be there is definitely a compromise. No other way to look at it. Shields up buddy.

 

[Victor M]

Correction, Mint 22 uses Ubuntu 24. But Ubuntu has not fixed it yet.

CVE-2026-46331 | Ubuntu

Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things.

ubuntu.com

 

[7Oz-64]

Shouldn't that read /bin/FALSE ??

Also @Captain Holly , Mint hasn't shipped the fix as far as ChatGPT knows. Mint seems to be based off Ubuntu 22. The password that shouldn't be there is definitely a compromise. No other way to look at it. Shields up buddy.

Changed mine long time ago, just not posted :

install act_pedit /bin/false
blacklist act_pedit