pedit COW: The Kernel Left the Gate Open (Again)
Oh good. A local privilege escalation in the Linux kernel. On a Monday. After a weekend where I already didn't sleep because one of the Lambs in accounting "accidentally" forwarded their credentials to a fake grain vendor.
I'm fine. Everything is fine.
So here's the situation. CVE-2026-46331, which someone with too much free time named "pedit COW," is an out-of-bounds write buried in the Linux kernel's traffic-control subsystem. Specifically in act_pedit, the packet-editing action component. It corrupts shared page-cache memory, which means a local unprivileged user can poison cached binaries and claw their way up to root.
Root. On a Linux box. Via the traffic-control layer. I need to lie down.
The truly delightful part is that a working public exploit dropped within ONE DAY of the CVE being assigned on June 16. One day. The Wolves out there are faster at weaponizing holes in the fence than our Shepherds are at approving a patch ticket. Red Hat flagged the severity as serious, which in Shepherd-speak means they'll acknowledge it in a meeting and then ask if it affects the SharePoint server.
It doesn't. But that's not the point.
Here's what actually matters: this is a LOCAL exploit. An attacker needs to already be on the machine. So either a Wolf got in through some other hole first, or, and I'm not ruling this out, one of your own Lambs is about to become a very motivated insider threat after they find this writeup on a forum.
Both scenarios are bad. Both scenarios are somehow your fault for not segmenting anything properly.
The flaw essentially lets unprivileged code corrupt the page cache, which is the kernel's way of sharing memory-mapped files across processes. Poison the right cached binary and suddenly your "nobody" user is running commands as root. It's elegant in the way that a slow carbon monoxide leak is elegant. You won't notice until it's too late and someone's already made themselves a cozy little nest in your infrastructure.
Remediation
Look, I'll keep this brief because I have seventeen tickets open.
Shear your kernels. Patch to a fixed version the moment your distro ships one. Red Hat, Debian, Ubuntu, check your vendor advisories NOW, not after the standup.
Restrict CAP_NET_ADMIN. If your Lambs don't need access to traffic-control subsystems, and they don't, lock it down with seccomp or AppArmor profiles.
Monitor for privilege escalation attempts. Auditd rules watching for unexpected setuid calls or suspicious tc command usage. Set it up before you need it.
Assume breach posture. If a Wolf is already inside the pen, this exploit is their next move. Lateral movement detection is not optional.
Anyway, I'm going to go stare at a log file until my eyes stop working.
Original Report: https://thehackernews.com/2026/06/new-linux-pedit-cow-exploit-enables.html