Linux Kernel 'pedit COW' Flaw CVE-2026-46331: Urgent Patch Required
A confirmed high-severity vulnerability in the Linux kernel's traffic-control subsystem, tracked as CVE-2026-46331 and nicknamed 'pedit COW,' enables local unprivileged users to gain root access on affected systems. All users of the Linux kernel are potentially impacted.
What happened
The 'pedit COW' vulnerability is an out-of-bounds write flaw in the packet-editing action (act_pedit) that corrupts shared page-cache memory, allowing an attacker to inject a payload into a setuid root binary like /bin/su and execute it with root privileges. The exploit does not modify the binary on disk, evading file-integrity checks.
To exploit this vulnerability, the act_pedit action must be loadable, and unprivileged user namespaces must be open, granting the attacker the CAP_NET_ADMIN capability needed to trigger the bug. On tested RHEL and Debian systems, both conditions were present.
The vulnerability was publicly disclosed on June 16, 2026, and a working exploit appeared shortly thereafter. Red Hat rates the flaw as important. Users are advised to upgrade to the latest version of the Linux kernel that patches this vulnerability to mitigate the risk.
How 0Day mitigates this
linux kernel is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.