CVE-2026-46331

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds write flaw exists in the traffic control packet editing (pedit) subsystem of the Linux kernel. In the tcf pedit act() function, the copy-on-write (COW) range for skb ensure writable() is computed once before iterating over edit keys using tcfp off max hint. However, this calculation fails to account for runtime header offsets added by typed keys, leaving part of the target write region without a proper copy-on-write. This allows a local unprivileged attacker to corrupt shared page-cache memory, potentially poisoning cached privileged binaries in memory (such as /bin/su) without altering the files on disk. This can be exploited to escalate privileges to root or cause a system crash. The issue is particularly exploitable in environments where unprivileged user namespaces are enabled.

Recommendations Apply vendor kernel updates immediately and reboot the system. Restrict the use of unprivileged user namespaces where operationally feasible. Monitor for unusual usage of the tc and unshare commands.