{"id":182332,"date":"2026-06-27T08:48:07","date_gmt":"2026-06-27T06:48:07","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/pedit-cow-i-dirtyclone-uyazvimosti-v-yadre-linux-pozvolyayushhie-poluchit-root-cherez-izmenenie-stranichnogo-kesha"},"modified":"2026-06-27T08:48:07","modified_gmt":"2026-06-27T06:48:07","slug":"pedit-cow-i-dirtyclone-uyazvimosti-v-yadre-linux-pozvolyayushhie-poluchit-root-cherez-izmenenie-stranichnogo-kesha","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/pedit-cow-i-dirtyclone-uyazvimosti-v-yadre-linux-pozvolyayushhie-poluchit-root-cherez-izmenenie-stranichnogo-kesha","title":{"rendered":"PEdit-CoW and DirtyClone \u2014 vulnerabilities in the Linux kernel that allow root access through cache page modifications.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Information has been revealed about two new vulnerabilities in the Linux kernel that allow a non-privileged user to gain root access by overwriting data in the page cache. Working exploits have been prepared for both vulnerabilities.<\/p>\n
\n
PEdit-CoW (CVE-2026-46331, exploit 1, exploit 2) \u2014 a flaw in the implementation of the copy-on-write mechanism in the code for modifying packet headers (act_pedit), used in the network packet scheduler (net\/sched), allows data to be written outside the allocated buffer, which can be exploited to overwrite data in the page cache at a specific offset. The issue arises because the check for a valid area to write data was performed without considering that the offset to edit fields may change during the operation.\n
The problem manifests starting from Linux kernel 5.18 and is fixed in releases 7.1, 7.0.13, 6.18.36, and 6.12.94. There is a reported possibility of exploiting this issue in RHEL 8\/9\/10, Debian 11\/12, openSUSE Leap 15.6, SUSE Linux 15-SP7\/16.0, and Ubuntu 18.04-25.10 (in Ubuntu version 26.4, the creation of user namespaces is blocked by default). As a workaround for protection, it is recommended to block the loading of the kernel module act_pedit (this will stop traffic shaping rules and header rewriting through 'tc pedit').<\/p>\n
DirtyClone (CVE-2026-43503, exploit) \u2014 a workaround for exploiting the Dirty Frag vulnerability in the xfrm-ESP module, used to accelerate encryption operations in IPsec using the ESP (Encapsulating Security Payload) protocol. In the new exploit, manipulation with the TEE extension to netfilter (the xt_TEE module) is used to clone skb structures.\n
The vulnerability has been fixed in Linux kernel releases 7.1, 7.0.10, 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, and 6.18.33. The issue manifests in Debian, Ubuntu, Fedora, \nRHEL, and SUSE. As a workaround to block the vulnerability, you can prevent the loading of the kernel modules esp4 and esp6.<\/p>\n<\/ul>\n
To exploit both vulnerabilities, CAP_NET_ADMIN access rights are required, which an unprivileged user can gain by creating user namespaces. In Ubuntu, such an operation is prohibited by default but can be allowed through sysctl 'kernel.apparmor_restrict_unprivileged_userns=0' or AppArmor profiles. In other distributions, the availability of 'user namespace' for unprivileged users depends on setting sysctl 'kernel.unprivileged_userns_clone' (if set to 0, it is prohibited). <\/p>\n
Exploitation of the vulnerabilities boils down to reading the program file \/bin\/su with the suid root flag, so that it resides in the page cache, and replacing part of the program's code in the page cache with code to run \/bin\/sh. The subsequent execution of the program will load into memory a modified copy from the page cache instead of the original executable file from the storage. <\/p>\n
Additionally, a notable exploit for CVE-2026-23111 in the nf_tables subsystem, which was resolved in the February updates of the Linux kernel, can be mentioned. This vulnerability is caused by accessing memory after it has been freed (use-after-free) and allows an unprivileged user to gain root rights in the system. For the attack, the user must also have the ability to create user namespaces. The operation of the exploit has been demonstrated in \nDebian 12\/13 and Ubuntu 22.04\/24.04. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"