Gkdev

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** An out-of-bounds write flaw exists in the `act pedit` (packet-editing action) of the Linux kernel traffic-control subsystem. The function `tcf pedit act()` incorrectly computes the Copy-on-Write (COW) range for `skb ensure writable()` by using `tcfp off max hint`, which fails to account for runtime header offsets added by typed keys. This allows part of the write region to remain un-COW'd, leading to the corruption of shared page-cache memory. A local unprivileged attacker can exploit this to poison cached privileged binaries in memory, such as `/bin/su`, without altering the files on disk, enabling local privilege escalation to root or causing a system crash. This issue is particularly exploitable in environments where unprivileged user namespaces are enabled, as they can grant namespace-scoped `CAP NET ADMIN` privileges. **Recommendations** Apply vendor kernel updates immediately and reboot the system. Restrict the use of unprivileged user namespaces where operationally feasible. Monitor for unusual use of `tc` and `unshare` commands. Review systems for unexpected privilege escalation activity.