New Linux pedit COW Exploit Enables Root Access by Poisoning Cached Binaries

CVE-2026-46331 ('pedit COW') is a critical out-of-bounds write vulnerability in the Linux kernel's traffic-control subsystem that allows unprivileged local users to escalate privileges to root by corrupting memory-cached binaries. The danger is compounded by the fact that a working public exploit was released within 24 hours of CVE assignment, dramatically shrinking the window organizations have to respond. The flaw is exploitable when two common kernel features — the act_pedit module and unprivileged user namespaces — are enabled, meaning many default Linux configurations are at risk. This highlights the persistent challenge of privilege escalation vulnerabilities in widely deployed operating systems and the critical importance of both rapid patching and reducing kernel attack surface through hardened configurations.