New Linux pedit COW Exploit Enables Root Access by Poisoning Cached Binaries
Summary: CVE-2026-46331, nicknamed "pedit COW," is an out-of-bounds write in the Linux kernel's act_pedit packet-editing action that corrupts shared page-cache memory, and a public working exploit appeared within a day of the CVE's assignment on June 16. The exploit poisons the cached in-memory copy of the setuid root binary /bin/su, injects a payload, and runs it as root, requiring only that act_pedit be loadable and unprivileged user namespaces be open; the PoC author reported unprivileged-to-root exploitation on RHEL 10 and Debian 13.
What you should know: The fix landed on the netdev mailing list in late May framed as a routine data-corruption patch, so the exploitable detail sat in public for weeks with no CVE and no security warning before a weaponized proof-of-concept followed the June 16 assignment within a day. Because the overwrite targets cached memory, file-integrity checks can come back clean while a root shell is already open, and dropping the page cache clears the poisoned copy but not the attacker's access.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-46331
- Related
- ⚡ Weekly Recap: Linux Kernel Flaws, AI Malware Tricks, Turla Backdoor, Infostealers and More Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026