CVE-2026-46331
published 2026-06-16CVE-2026-46331: In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes…
PriorityP342high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.32%
24.0th percentile
In the Linux kernel, the following vulnerability has been resolved:
net/sched: fix pedit partial COW leading to page cache corruption
tcf_pedit_act() computes the COW range for skb_ensure_writable()
once before the key loop using tcfp_off_max_hint, but the hint does
not account for the runtime header offset added by typed keys. This
can leave part of the write region un-COW'd.
Fix by moving skb_ensure_writable() inside the per-key loop where
the actual write offset is known, and add overflow checking on the
offset arithmetic. For negative offsets (e.g. Ethernet header edits
at ingress), use skb_cow() to COW the headroom instead. Guard
offset_valid() against INT_MIN, where negation is undefined.
Affected
34 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 4.19.244 < 4.20 | 4.20 |
| linux | linux | >= 5.10.117 < 5.10.260 | 5.10.260 |
| linux | linux | >= 5.15.41 < 5.15.211 | 5.15.211 |
| linux | linux | >= 5.17.9 < 5.18 | 5.18 |
| linux | linux | >= 5.4.195 < 5.5 | 5.5 |
| linux | linux | >= 8b796475fd7882663a870456466a4fb315cc1bd6 < a071e057518decc5e3bec89855758f5f8786f2c5 | a071e057518decc5e3bec89855758f5f8786f2c5 |
| linux | linux | >= 8b796475fd7882663a870456466a4fb315cc1bd6 < b685d6ef6f07a3b5ce814565a25f39f2157538a5 | b685d6ef6f07a3b5ce814565a25f39f2157538a5 |
| linux | linux | >= 8b796475fd7882663a870456466a4fb315cc1bd6 < 2bec122b9fb91507a758ab5e3e5c4fbe7cb3f61b | 2bec122b9fb91507a758ab5e3e5c4fbe7cb3f61b |
| linux | linux | >= 8b796475fd7882663a870456466a4fb315cc1bd6 < b198ed4e52580a7238c7c7082f03906f8b310313 | b198ed4e52580a7238c7c7082f03906f8b310313 |
| linux | linux | >= 8b796475fd7882663a870456466a4fb315cc1bd6 < 3dee9d0c198faeb95d052c1b94c2958751a28512 | 3dee9d0c198faeb95d052c1b94c2958751a28512 |
| linux | linux | >= 8b796475fd7882663a870456466a4fb315cc1bd6 < 899ee91156e57784090c5565e4f31bd7dbffbc5a | 899ee91156e57784090c5565e4f31bd7dbffbc5a |
| linux | linux | >= abe35bf3be51482593076d516a680d79e5fbc8e1 < 544d857b42a1734b923040e13aa61a6fd4746cf2 | 544d857b42a1734b923040e13aa61a6fd4746cf2 |
| linux | linux | >= b773640d5bb9e2acfd91e2695717af04d47aa116 < d5d01d35a5a7d36f7cb679b67d9cbdd5205672dc | d5d01d35a5a7d36f7cb679b67d9cbdd5205672dc |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: net/sched: act_pedit: extend the writable skb range per key
vendor_redhat·2026-05-18·CVSS 7.8
CVE-2026-46331 [HIGH] CWE-787 kernel: net/sched: act_pedit: extend the writable skb range per key
kernel: net/sched: act_pedit: extend the writable skb range per key
A flaw was found in the Linux kernel's traffic control packet editing (pedit) subsystem. In tcf_pedit_act(), the copy-on-write (COW) range for skb_ensure_writable() is computed once before iterating over edit keys, but the calculation does not account for runtime header offsets added by typed keys. This can leave part of the target write region without a proper copy-on-write, leading to an out-of-bounds write that corrupts page cache memory. A local attacker with the ability to configure traffic control rules could exploit this to escalate privileges or crash the system.
Statement: Red Hat rates this flaw as Important severity.
This vulnerability is in the kernel's traffic control (tc) pedit action, which requires CAP_NE
GHSA
In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable()
ghsa_unreviewed·2026-06-16
CVE-2026-46331 In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable()
In the Linux kernel, the following vulnerability has been resolved:
net/sched: fix pedit partial COW leading to page cache corruption
tcf_pedit_act() computes the COW range for skb_ensure_writable()
once before the key loop using tcfp_off_max_hint, but the hint does
not account for the runtime header offset added by typed keys. This
can leave part of the write region un-COW'd.
Fix by moving skb_ensure_writable() inside the per-key loop where
the actual write offset is known, and add overflow checking on the
offset arithmetic. For negative offsets (e.g. Ethernet header edits
at ingress), use skb_cow() to COW the headroom instead. Guard
offset_valid() against INT_MIN, where negation is undefined.
No detection rules found.
No public exploits indexed.
Hackernews
⚡ Weekly Recap: Linux Kernel Flaws, AI Malware Tricks, Turla Backdoor, Infostealers and More
blogs_hackernews·2026-06-29·CVSS 8.8
CVE-2026-43503 [HIGH] ⚡ Weekly Recap: Linux Kernel Flaws, AI Malware Tricks, Turla Backdoor, Infostealers and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: Linux Kernel Flaws, AI Malware Tricks, Turla Backdoor, Infostealers and More
This week was a reminder that attackers do not always need big tricks. One small mistake, one old access path, one missed patch, and suddenly the door is open.
The noise is not all noise, either. Forums are talking, researchers are finding easy cracks, and defenders have more cleanup waiting.
Here’s the full Monday recap.
## ⚡ Threat of the Week
New DirtyClone Linux Kernel Flaw Lets Local Users Gain Root via Cloned Packets — Cybersecurity researchers detailed a new variant of the Dirty Frag Linux kernel flaw. Called DirtyClone (
Hackernews
New Linux pedit COW Exploit Enables Root Access by Poisoning Cached Binaries
blogs_hackernews·2026-06-26
CVE-2026-46331 New Linux pedit COW Exploit Enables Root Access by Poisoning Cached Binaries
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## New Linux pedit COW Exploit Enables Root Access by Poisoning Cached Binaries
A flaw in the Linux kernel's traffic-control subsystem can let a local unprivileged user gain root on affected systems.
CVE-2026-46331 , nicknamed " pedit COW ," is an out-of-bounds write in the packet-editing action (act_pedit) that corrupts shared page-cache memory. A public, working exploit appeared within a day of the CVE assignment on June 16. Red Hat rates the flaw as important .
The exploit never touches the file on disk. It poisons the cached copy of a setuid root binary (/bin/su) in memory, injects a small payload, and runs that altered im
Bugzilla
CVE-2026-46331 kernel: net/sched: act_pedit: extend the writable skb range per key
bugzilla·2026-05-18
CVE-2026-46331 [HIGH] CVE-2026-46331 kernel: net/sched: act_pedit: extend the writable skb range per key
CVE-2026-46331 kernel: net/sched: act_pedit: extend the writable skb range per key
tcf_pedit_act() builds a rough writable prefix from tcfp_off_max_hint
before the action mutates any packet bytes.
Since 6c02568fd1ae, TCP and UDP keys recompute their L4 base from the
current L3 header inside the key loop. An earlier key can therefore
change a later header-relative base and make the final store land
outside the initially ensured prefix, where it can fall back to
skb_store_bits() on skb frags.
Keep the initial estimate as a fast path, but grow the ensured writable
range from each key's final computed write offset before loading or
storing the edited word.
https://git.kernel.org/stable/c/2bec122b9fb91507a758ab5e3e5c4fbe7cb3f61bhttps://git.kernel.org/stable/c/3dee9d0c198faeb95d052c1b94c2958751a28512https://git.kernel.org/stable/c/544d857b42a1734b923040e13aa61a6fd4746cf2https://git.kernel.org/stable/c/899ee91156e57784090c5565e4f31bd7dbffbc5ahttps://git.kernel.org/stable/c/a071e057518decc5e3bec89855758f5f8786f2c5https://git.kernel.org/stable/c/b198ed4e52580a7238c7c7082f03906f8b310313https://git.kernel.org/stable/c/b685d6ef6f07a3b5ce814565a25f39f2157538a5https://git.kernel.org/stable/c/d5d01d35a5a7d36f7cb679b67d9cbdd5205672dchttps://access.redhat.com/errata/RHSA-2026:27288https://access.redhat.com/errata/RHSA-2026:27353https://access.redhat.com/errata/RHSA-2026:27354https://access.redhat.com/errata/RHSA-2026:27355https://access.redhat.com/errata/RHSA-2026:27704https://access.redhat.com/errata/RHSA-2026:27705https://access.redhat.com/errata/RHSA-2026:27706https://access.redhat.com/errata/RHSA-2026:27707https://access.redhat.com/errata/RHSA-2026:27708https://access.redhat.com/errata/RHSA-2026:27709https://access.redhat.com/errata/RHSA-2026:27713https://access.redhat.com/errata/RHSA-2026:27731https://access.redhat.com/errata/RHSA-2026:27789https://access.redhat.com/errata/RHSA-2026:28887https://access.redhat.com/errata/RHSA-2026:28962https://access.redhat.com/errata/RHSA-2026:29080https://access.redhat.com/errata/RHSA-2026:29794https://access.redhat.com/errata/RHSA-2026:29799https://access.redhat.com/errata/RHSA-2026:29833https://access.redhat.com/errata/RHSA-2026:29856https://access.redhat.com/errata/RHSA-2026:29863https://access.redhat.com/errata/RHSA-2026:33219https://access.redhat.com/errata/RHSA-2026:33220https://access.redhat.com/errata/RHSA-2026:33221https://access.redhat.com/errata/RHSA-2026:33222https://access.redhat.com/errata/RHSA-2026:33223https://access.redhat.com/errata/RHSA-2026:33224https://access.redhat.com/errata/RHSA-2026:33225https://access.redhat.com/errata/RHSA-2026:33666https://access.redhat.com/errata/RHSA-2026:34048https://access.redhat.com/errata/RHSA-2026:34098https://access.redhat.com/security/cve/CVE-2026-46331https://bugzilla.redhat.com/show_bug.cgi?id=2479492https://github.com/sgkdev/packet_edit_meme/tree/mainhttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46331.json
2026-06-16
Published