cherrycherrymay/poc-cve-2026-46331Pedit COW – Linux Kernel Local Privilege Escalation (CVE-2026-46331)
This repository contains a proof-of-concept (PoC) exploit for CVE-2026-46331, a Linux kernel local privilege escalation vulnerability in the traffic-control subsystem.
Vulnerability Summary
The flaw exists in the act_pedit packet-editing action, where the kernel may calculate the copy-on-write writable range incorrectly before all runtime packet offsets are fully known. Under the right local conditions, this can allow writes into shared page cache memory.
Impact
An unprivileged local user can abuse this behavior to poison the in-memory cached copy of a setuid-root binary such as /bin/su.
The original file on disk is not modified, so file-integrity checks may still look clean. Executing the cached binary can result in a root shell.
Affected Systems
This issue affects Linux systems where:
The vulnerable kernel code is present, and Local users can access the required namespace and traffic-control functionality.
Fixed versions vary by distribution.
Resources
NVD – CVE-2026-46331 TuxCare: pedit COW Analysis Public PoC: packet_edit_meme
