Gkdev

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** An out-of-bounds write flaw exists in the traffic control packet editing (pedit) subsystem of the Linux kernel. In the `tcf pedit act()` function, the copy-on-write (COW) range for `skb ensure writable()` is computed once before iterating over edit keys using `tcfp off max hint`. However, this calculation fails to account for runtime header offsets added by typed keys, leaving part of the target write region without a proper copy-on-write. This allows a local unprivileged attacker to corrupt shared page-cache memory, potentially poisoning cached privileged binaries in memory (such as `/bin/su`) without altering the files on disk. This can be exploited to escalate privileges to root or cause a system crash. The issue is particularly exploitable in environments where unprivileged user namespaces are enabled. **Recommendations** Apply vendor kernel updates immediately and reboot the system. Restrict the use of unprivileged user namespaces where operationally feasible. Monitor for unusual usage of the `tc` and `unshare` commands.