Loading story…
Red Hat disclosed CVE-2026-46331, an important local privilege escalation vulnerability in the Linux kernel’s traffic control subsystem, specifically the act_pedit module. The flaw stems from a missing bounds check in tcf_pedit_act() that can lead to an out-of-bounds write and page cache memory corruption, potentially allowing a local user to gain root privileges. Red Hat said RHEL 8, 9, and 10 are directly affected, along with Red Hat Enterprise Linux for NVIDIA and Red Hat OpenShift Container Platform, though OpenShift exposure is considered low because the vulnerable module is not loaded by default.
Technical details show the bug arises when packet-editing keys recompute Layer 4 offsets during processing, allowing an earlier mutation to influence a later write beyond the originally validated writable packet range. Red Hat has issued fixes across multiple product lines, including RHEL variants, SAP Solutions, Telecommunications Update Service, Extended Update Support, Advanced Mission Critical Update Support, and NVIDIA for RHEL 10, while warning that products built on the RHEL kernel such as RHEL CoreOS, Red Hat OpenStack Platform, and Red Hat Virtualization may also be impacted. As a mitigation, Red Hat advised administrators to blacklist the act_pedit kernel module and verify whether it is loaded before unloading it or rebooting.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Red Hat stated the issue had been addressed across multiple products, including RHEL 8, 9, and 10 variants and other offerings, through multiple RHSA advisories issued in June 2026. The source does not provide specific advisory issue dates for each product.
SUSE Bugzilla tracked CVE-2026-46331 and linked it to multiple important kernel security advisories affecting SUSE Linux Enterprise, SUSE Linux Micro, openSUSE Leap, live patching, and real-time kernel packages. The entry also summarized the upstream fix for the pedit handling flaw and referenced upstream commit 899ee91156e57784090c5565e4f31bd7dbffbc5a.
Red Hat's Bugzilla entry described how mutations in tcf_pedit_act() could alter later header-relative offsets and lead to an out-of-bounds write beyond the originally ensured writable prefix. The entry also stated the fix expands the ensured writable range using each key's final computed write offset before packet edits.
Red Hat disclosed CVE-2026-46331 as an important local privilege escalation vulnerability in the Linux kernel traffic control subsystem's act_pedit module. It said RHEL 8, 9, and 10 and related products were affected, and recommended blacklisting the act_pedit module as a mitigation.
An upstream Linux kernel commit fixed the tc pedit flaw by replacing coarse writable-range handling with per-operation validation, adding integer overflow checks, and using safer writable packet access patterns. The patch removed tcfp_off_max_hint and updated act_pedit code to prevent out-of-bounds access and unsafe packet modification behavior.
The Debian security tracker published an entry for CVE-2026-46331, indicating the vulnerability had been cataloged in Debian's tracking system.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourcebugzilla.suse.com
Open sourceaccess.redhat.com
Open sourcebugzilla.suse.com
Open sourcegit.kernel.org
Open sourcesecurity-tracker.debian.org
Open sourcesecurity-tracker.debian.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two newly disclosed Linux kernel local privilege escalation flaws are enabling attackers to gain root by corrupting file-backed page-cache memory without changing files on disk. **DirtyClone** (`CVE-2026-43503`) affects the XFRM/IPsec path and abuses cloned packets after a shared-fragment safety flag is dropped during internal copying, while **pedit COW** (`CVE-2026-46331`) affects the traffic-control `act_pedit` subsystem through an out-of-bounds write. Public exploit material shows both bugs can poison the in-memory copy of privileged binaries such as `/usr/bin/su` or `/bin/su`, then execute them to obtain root access while evading file-integrity checks and, in DirtyClone’s case, potentially leaving no on-disk changes or kernel audit evidence. Exploitation in both cases depends on local access plus `CAP_NET_ADMIN`, which researchers say can often be obtained through unprivileged user namespaces on distributions such as Debian, Fedora, and RHEL by default. Reported testing showed successful exploitation on Debian 13 and RHEL 10, with Ubuntu 24.04 requiring an AppArmor-permitted path and Ubuntu 26.04 blocking some default routes despite vulnerable kernels. Upstream fixes have already landed in the Linux 7.1 release candidates, and vendors including Ubuntu, Debian, SUSE, and Red Hat have issued advisories or patches; defenders are being urged to deploy patched kernels, reboot affected systems, and consider disabling unprivileged user namespaces or blocking `act_pedit` where immediate patching is not possible.
Jul 3, 2026
`CVE-2026-31431` is a Linux kernel flaw classified as **CWE-669: Incorrect Resource Transfer Between Spheres** that can enable local privilege escalation to root and, in some cases, bypass isolation boundaries. The Canadian Centre for Cyber Security warned that the impact becomes more severe when the bug is chained with a remote code execution vulnerability, and urged organizations to identify exposed systems, apply vendor fixes, reboot after kernel updates, restrict access, enforce kernel security controls, monitor logs, and segment high-risk or Internet-facing workloads. Vendor and community activity indicates broad exposure across modern Linux platforms. Red Hat lists **RHEL 8**, **RHEL 9**, **RHEL 10**, and corresponding `kernel-rt` packages as affected, while **RHEL 6** and **RHEL 7** are marked not affected because the vulnerable code is absent. Public exploit interest accelerated after Theori published the **"Copy Fail"** technical write-up and proof-of-concept repository, which references testing on **Ubuntu 24.04 LTS**, **Amazon Linux 2023**, **RHEL 10.1**, and **SUSE 16**; Rocky Linux also published related errata, signaling downstream patch availability in enterprise Linux ecosystems.
Jun 29, 2026
Public proof-of-concept exploit code was released for **DirtyDecrypt** (`CVE-2026-31635`), a high-severity Linux kernel local privilege escalation flaw caused by a missing copy-on-write guard in `rxgk_decrypt_skb()` within the RxGK subsystem. The bug allows unprivileged local users to corrupt shared page-cache memory tied to privileged files or processes, potentially overwriting targets such as `/etc/shadow`, `/etc/sudoers`, or SUID binaries to gain **root**. Reports said the issue was quietly patched upstream in late April and primarily affects systems using mainline or rolling-release kernels with `CONFIG_RXGK` enabled, including **Fedora**, **Arch Linux**, and **openSUSE Tumbleweed**; the risk is elevated on Kubernetes worker nodes and developer workstations because exploitation can also enable container escape and theft of secrets or runtime sockets. At the same time, researchers disclosed **PinTheft**, another Linux local privilege escalation exploit that abuses a double-free or refcount bug in the **RDS zerocopy send path** and uses `io_uring` fixed buffers to turn the flaw into a page-cache overwrite against a SUID-root binary. The exploit, credited to Aaron Esau of V12 Security, reportedly drains page references through failed RDS zerocopy sends, frees the page, reclaims it as page cache, and overwrites it with a malicious ELF payload that yields a root shell when executed. Mailing list discussion said a patch and proof of concept are available, with exploitability depending on the `rds` kernel module being present or autoloadable; **Arch Linux** was reported to enable it by default, while Fedora may also be exposed and Debian and Ubuntu appear to have mitigations that restrict autoloading.
Jun 29, 2026