Information has been revealed about two new vulnerabilities in the Linux kernel that allow a non-privileged user to gain root access by overwriting data in the page cache. Working exploits have been prepared for both vulnerabilities.
- PEdit-CoW (CVE-2026-46331, exploit 1, exploit 2) — a bug in the implementation of the copy-on-write mechanism in the packet header modification code (act_pedit), used in the network packet scheduler (net/sched), allows writing data beyond the allocated buffer, which can be used to overwrite data in the page cache at a chosen offset. The error occurs because the check for a valid area for writing data was performed without considering that the offset for editable fields may change during the execution of the operation.
The issue manifests starting from Linux kernel 5.18 and has been fixed in versions 7.1, 7.0.13, 6.18.36, and 6.12.94. Exploitation of the issue has been reported in RHEL 8/9/10, Debian 11/12, openSUSE Leap 15.6, SUSE Linux 15-SP7/16.0, and Ubuntu 18.04-25.10 (creating a user namespace is blocked by default in Ubuntu version 26.4). As a workaround, it is recommended to block the loading of the kernel module act_pedit (traffic limitation rules and header rewriting via 'tc pedit' will stop working).
echo "blacklist act_pedit" > /etc/modprobe.d/blacklist-act-pedit.conf
rmmod act_pedit - DirtyClone (CVE-2026-43503, exploit) — a workaround for exploiting the Dirty Frag vulnerability in the xfrm-ESP module, used to accelerate encryption operations in IPsec using the ESP (Encapsulating Security Payload) protocol. The new exploit uses manipulation with the TEE extension for netfilter (module xt_TEE), which performs the operation of cloning network packets.
The vulnerability has been fixed in Linux kernel releases 7.1, 7.0.10, 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, and 6.18.33. The issue manifests in Debian, Ubuntu, Fedora,
RHEL, and SUSE. As a workaround to block the vulnerability, you can prevent the loading of the kernel modules esp4 and esp6.
Exploiting both vulnerabilities requires CAP_NET_ADMIN access, which an unprivileged user can obtain by creating user namespaces. In Ubuntu, such an operation is disabled by default but can be enabled via the sysctl "kernel.apparmor_restrict_unprivileged_userns=0" or AppArmor profiles. In other distributions, the availability of user namespaces to unprivileged users depends on the sysctl setting "kernel.unprivileged_userns_clone" (if set to 0, it is prohibited).
Exploitation of the vulnerabilities boils down to reading the program file /bin/su with the suid root flag, so that it resides in the page cache, and replacing part of the program's code in the page cache with code to run /bin/sh. The subsequent execution of the program will load into memory a modified copy from the page cache instead of the original executable file from the storage.
Additionally, a notable exploit for CVE-2026-23111 in the nf_tables subsystem, which was resolved in the February updates of the Linux kernel, can be mentioned. This vulnerability is caused by accessing memory after it has been freed (use-after-free) and allows an unprivileged user to gain root rights in the system. For the attack, the user must also have the ability to create user namespaces. The operation of the exploit has been demonstrated in
Debian 12/13 and Ubuntu 22.04/24.04.
Source: opennet.ru
