[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPSeg7DLQ74m9FSHC6P8BVtuRhHxWk6B8wwBGa7JL7Zg":3},{"article":4,"iocs":43,"watch_terms":48,"solutions":49,"lesson":139},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"a633e0e5-5bc1-4b57-9921-adb3e2cf2495","New Linux pedit COW Exploit Enables Root Access by Poisoning Cached Binaries","new-linux-pedit-cow-exploit-enables-root-access-by-poisoning-cached-binaries-1b5999","A flaw in the Linux kernel's traffic-control subsystem can let a local unprivileged user gain root on affected systems. CVE-2026-46331, nicknamed \"pedit COW,\" is an out-of-bounds write in the packet-editing action (act_pedit) that corrupts shared page-cache memory. A public, working exploit appeared within a day of the CVE assignment on June 16. Red Hat rates the flaw as","CVE-2026-46331, nicknamed \"pedit COW,\" is a critical out-of-bounds write vulnerability in the Linux kernel's traffic-control subsystem that allows unprivileged local users to gain root access by corrupting cached binaries in memory. A public working exploit was released within a day of the CVE assignment on June 16, 2026. The flaw affects RHEL 8\u002F9\u002F10, Debian 11\u002F12\u002F13, and Ubuntu 18.04 through 26.04, with exploitation requiring act_pedit module loadability and unprivileged user namespaces to be enabled.","Linux kernel pedit COW flaw (CVE-2026-46331) allows local unprivileged users to gain root access via binary poisoning.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F06\u002Fnew-linux-pedit-cow-exploit-enables.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEj0PC1aWOiorYx2AGD7fl-IVefJBKPJvjy7sMo5MURoMlaq492QcSdpSqqdGZRZk3u3e6BMS7qVzrJXBuWk-kH4oRqQy1cHTxkvHBLMMbllF9R_rNqL618rz5zEV_FfOvE0_YQgI-VVWbVX772Bc72qSphwMK-TtOAoZ5A9swYpvSNYsFfdR17i8AAXXzDZ\u002Fs1600\u002Flinux-hack.jpg","2026-06-26T13:00:41+00:00","2026-06-26T14:00:37.517005+00:00",9,[17,20,23,25,28,30],{"name":18,"type":19},"Linux kernel traffic-control subsystem","technology",{"name":21,"type":22},"act_pedit","product",{"name":24,"type":19},"user namespaces",{"name":26,"type":27},"Red Hat","vendor",{"name":29,"type":27},"Debian",{"name":31,"type":27},"Ubuntu","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",[44],{"type":45,"value":46,"context":47},"cve","CVE-2026-46331","Out-of-bounds write in Linux kernel act_pedit causing privilege escalation",[26,29,31],{"controls":50,"vendors":138},[51,80,109],{"slug":52,"name":53,"problem":54,"products":55},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[56,64,72],{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":60,"product_name":61,"url":62,"description":63},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"slug":81,"name":82,"problem":83,"products":84},"patch-management","Automated patch management","Known holes get closed in days, not months.",[85,93,101],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":110,"name":111,"problem":112,"products":113},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[114,122,130],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",[],{"slug":140,"title":141,"body":142,"framework_refs":143,"framework_notes":155},"linux-kernel-pedit-cow-flaw-grants-root-access-via-cached-binary-poisoning","Linux Kernel 'pedit COW' Flaw Grants Root Access via Cached Binary Poisoning","CVE-2026-46331 ('pedit COW') is a critical out-of-bounds write vulnerability in the Linux kernel's traffic-control subsystem that allows unprivileged local users to escalate privileges to root by corrupting memory-cached binaries. The danger is compounded by the fact that a working public exploit was released within 24 hours of CVE assignment, dramatically shrinking the window organizations have to respond. The flaw is exploitable when two common kernel features — the act_pedit module and unprivileged user namespaces — are enabled, meaning many default Linux configurations are at risk. This highlights the persistent challenge of privilege escalation vulnerabilities in widely deployed operating systems and the critical importance of both rapid patching and reducing kernel attack surface through hardened configurations.",[144,145,146,147,148,149,150,151,152,153,154],"CIS Control 7: Continuous Vulnerability Management","CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 8: Audit Log Management","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST CM-6: Configuration Settings","NIST CM-7: Least Functionality (disable unnecessary kernel features)","NIST AC-6: Least Privilege","NIST SI-7: Software, Firmware, and Information Integrity","ITIL Change Management: Emergency Change Procedures","GDPR Article 32: Security of Processing (technical measures to ensure integrity)",{}]