Pedit COW Exploit Enables Linux Root Access

CVE-2026-46331, nicknamed 'pedit COW', is a critical out-of-bounds write vulnerability in the Linux kernel's traffic-control subsystem (act_pedit). The flaw allows an unprivileged local user with CAP_NET_ADMIN capabilities—often available by default in user namespaces—to corrupt the shared page cache. This enables attackers to modify in-memory copies of sensitive binaries, such as /bin/su, to execute arbitrary shellcode as root.

The vulnerability stems from an incorrect copy-on-write (COW) calculation that fails to account for runtime header offsets, leading to the modification of shared memory instead of private copies. A weaponized proof-of-concept named 'PACKET_EDIT_MEME' has been publicly released and verified to achieve root on RHEL 10, Debian 13, and Ubuntu 24.04 (via AppArmor bypass).

This flaw is part of a growing class of page-cache corruption vulnerabilities like Dirty Pipe and Copy Fail. It poses a significant risk to multi-tenant environments, container hosts, and CI/CD runners where local user isolation is critical for security.