CVE-2026-46331: order COW, the failure that allows local users to climb to root in Linux

On June 16, the vulnerability CVE-2026-46331 - nicknamed "Pit COW" - was assigned that allows an unprivileged local user to climb to root in kernel Vulnerable Linux using off-limits writing in the act _ pedit of the traffic control subsystem. In short, the kernel aims to apply a copy-on-write pattern but miscalculates the private area to be modified, which causes the writing to alter a shared page of the cache page rather than a private copy; if that page contains the memory image of a setuid binary (e.g. / bin / su), the explosion can inject code into the memory copy and run a root shell without touching the disk or leaving prints on the file integrity cheques.

The vector that turns the bug into a realistic exploitation It is not just the corruption of the cache page, but the possibility that unprivileged users set up tc rules from an unprivileged user namespace. That capacity gives them a local network capacity (CAP _ NET _ ADMIN) within the namespace and it is exactly what the explosion needs to activate act _ pedit. The result is a chain of operation that especially affects multi-user or shared environments: Kubernetes nodes, CI / CD runners, laboratory machines, research environments and multiple-account servers.

The vulnerability pattern reminds of previous failures like Dirty Pipe and others who wrote on pages that were not their exclusive property, but the new here is the way in for unprivileged users. According to public reports, the functional PoC appeared 24 hours after the CVE allocation and was tested in RHEL and Debian where unprivileged namespaces are opened by default; Ubuntu showed differences according to the management of AppArmor in each version. For technical details and official follow-up see the CVE tab on the NVD and the Debian Tracker: NVD - CVE-2026-46331 and Debian Security Tracker - CVE-2026-46331.

Recommended immediate action: install the patched kernel and restart as soon as possible. This is the only definitive arrangement: the fix corrects the copy logic and prevents the corruption of the cache page. Prioritize updates in hosts where "local user" is potentially malicious or not fully reliable: multi-tenant environments, container nodes, CI runners, shared machines and stations that perform third-party work.

If you can't park immediately, there are effective mitigations that cut the chain of the explosion. The first is to prevent act _ pedit from being available as a module: check with lsmod ¥124; grep act _ pedit if the module is loaded and, if you do not need it, block it by creating a file in / etc / modprobe.d /, for example do "install act _ pedit / bin / false" > / etc / modprobe.d / disable-act _ pedit.conf; if the module is already loaded try rmmod _ pedit (can fail if it is in use). The second is to disable the unprivileged user namespaces that grant the local CAP _ NET _ ADMIN: in RHEL use sysctl -w user.max _ user _ namespaces = 0 and in Debian / Ubuntu sysctl -w kernel .unprivileged _ userns _ clone = 0. Try it before, because this breaks rootless containers, some CI sandboxes and sandboxed browsers.

Do not trust file integrity checks as the only forensic evidence: the explosion alters the memory copy of the file on the cache page without changing the disk, so add SHA or AIDE tools can return the images "clean" even if there is an already open root shell. Empty the page cache with echo 3 > / proc / sys / vm / drop _ caches will remove the copy in poisoned memory, but do not reverse or delete established root sessions; if you suspect commitment, treat the host as committed: network isolation, collect memory and forensic analysis devices and plan a reinstallation or restoration from reliable backups.

In addition to patching and applying mitigation, check configurations and detections: check modules with lsmod, audit the presence of allowed user namespaces, monitor the appearance of shells with unusual permissions and look for unexpected processes that have started shortly after the last kernel update. Note that the correction appeared on the public list netdev weeks before the allocation of the CVE, so waiting for scanner rules or signatures can be too slow; in corruption failures of the page cache it is appropriate to prioritize the response based on the understanding of the vector and the application of mitigations until the patch is applied.

To be kept informed about the evolution and patches per distributor, see the official channels of your supplier and the security pages: in addition to the NVD and Debian Tracker, Red Hat and Ubuntu notices publish specific instructions by version and packaging. Now act: it is not a theoretical vulnerability, there is a public PoC and exploitation does not leave the traditional print on disk.