CVE-2026-46331

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds write flaw exists in the act pedit (packet-editing action) of the Linux kernel traffic-control subsystem. The function tcf pedit act() incorrectly computes the Copy-on-Write (COW) range for skb ensure writable() by using tcfp off max hint, which fails to account for runtime header offsets added by typed keys. This allows part of the write region to remain un-COW'd, leading to the corruption of shared page-cache memory. A local unprivileged attacker can exploit this to poison cached privileged binaries in memory, such as /bin/su, without altering the files on disk, enabling local privilege escalation to root or causing a system crash. This issue is particularly exploitable in environments where unprivileged user namespaces are enabled, as they can grant namespace-scoped CAP NET ADMIN privileges.

Recommendations Apply vendor kernel updates immediately and reboot the system. Restrict the use of unprivileged user namespaces where operationally feasible. Monitor for unusual use of tc and unshare commands. Review systems for unexpected privilege escalation activity.