pedit COW (CVE-2026-46331): локальная эскалация до root через заражение page-cache

Colleagues, a security alert: pedit COW (CVE-2026-46331) — a local privilege escalation to root.

Summary: act_pedit writes into the shared page cache without touching disk; an exploit modifies a cached setuid binary (e.g. /bin/su) and executes it as root.

Prerequisites: loadable act_pedit module and unprivileged user namespaces enabled (CAP_NET_ADMIN). Observed on RHEL10 and Debian13.

Mitigation: install a patched kernel and reboot. If immediate patching is impossible, blacklist the module:

echo 'install act_pedit /bin/true' | sudo tee /etc/modprobe.d/disable-act_pedit.conf

or disable unprivileged namespaces.

Why it matters: page-cache infection bypasses integrity checks and may remain undetected.

Update your kernels immediately?

#cybersecurity #Linux #vulnerability #infosec