Exploit for CVE-2026-46331

## https://sploitus.com/exploit?id=BDDADE0B-C11C-55AD-AC1E-1C4477E65931
# 🚨 CVE-2026-46331 - Linux Kernel COW Bug



### Linux Kernel `net/sched` Partial Copy-on-Write (COW) Page Cache Corruption

![Platform](https://img.shields.io/badge/Platform-Linux-blue?style=for-the-badge&logo=linux)
![Severity](https://img.shields.io/badge/Type-Kernel%20Memory%20Corruption-red?style=for-the-badge)
![Component](https://img.shields.io/badge/Component-net%2Fsched%20(pedit)-orange?style=for-the-badge)
![Status](https://img.shields.io/badge/Patch-Available-success?style=for-the-badge)

*A Linux kernel vulnerability caused by incorrect Copy-on-Write (COW) handling in the traffic control (`tc`) packet editing subsystem.*



---

# 📖 Overview

**CVE-2026-46331** is a Linux kernel vulnerability affecting the **`net/sched` packet editing (`act_pedit`)** subsystem.

The vulnerability occurs because the kernel calculates the writable Copy-on-Write (COW) range **before** the actual packet-edit offset is known. When runtime header offsets are applied, portions of memory may remain writable without being copied, resulting in **page cache corruption**.

Under specific conditions, this corruption can become a powerful primitive for **local privilege escalation (LPE)** or kernel instability. :contentReference[oaicite:0]{index=0}

---

# 🔍 Technical Details

## Vulnerable Component

```
Linux Kernel
└── net/
    └── sched/
        └── act_pedit.c
```

Affected function:

```c
tcf_pedit_act()
```

Problem:

```
skb_ensure_writable()
        │
        ▼
Calculates writable range only once
        │
        ▼
Runtime header offsets change later
        │
        ▼
Memory outside COW region is modified
        │
        ▼
Page Cache Corruption
```

---

# 💥 Root Cause

The vulnerable implementation:

- Computes the writable region only once.
- Uses `tcfp_off_max_hint`.
- Does **not** account for runtime offsets introduced by typed packet-edit keys.
- Writes beyond the copied region.

This creates a partial Copy-on-Write condition that can corrupt cached kernel pages. :contentReference[oaicite:1]{index=1}

---

# ⚠️ Impact

Possible consequences include:

- Kernel memory corruption
- Page cache corruption
- System crashes
- Undefined kernel behavior
- Potential Local Privilege Escalation (LPE)
- Privileged code execution under favorable conditions :contentReference[oaicite:2]{index=2}

---

# 🎯 Attack Requirements

An attacker generally requires:

- Local code execution
- Ability to configure Linux Traffic Control (`tc`)
- `CAP_NET_ADMIN` (directly or through an unprivileged user namespace, depending on system configuration)

No remote attack vector has been described in the official advisory. :contentReference[oaicite:3]{index=3}

---

# 📸 Demo 



---

# 📦 Affected Component

```
Traffic Control (tc)

        │

 act_pedit

        │

 tcf_pedit_act()

        │

 skb_ensure_writable()

        │

 Partial COW

        │

 Page Cache Corruption
```

---

# 🛠 Fix

The upstream kernel patch:

- Moves `skb_ensure_writable()` inside the per-key processing loop.
- Uses the actual runtime write offset.
- Adds integer overflow validation.
- Uses `skb_cow()` for negative offsets.
- Prevents invalid offset arithmetic (`INT_MIN`). :contentReference[oaicite:4]{index=4}

---

# 🛡 Mitigation

- ✅ Update to a patched Linux kernel.
- ✅ Restrict `CAP_NET_ADMIN`.
- ✅ Disable unnecessary `tc` packet-edit rules.
- ✅ Limit unprivileged user namespaces where operationally appropriate.
- ✅ Reboot after installing the fixed kernel. :contentReference[oaicite:5]{index=5}

---

# 📊 Summary

| Field | Value |
|-------|-------|
| CVE | CVE-2026-46331 |
| Component | Linux Kernel `net/sched` |
| Module | `act_pedit` |
| Vulnerability | Partial Copy-on-Write |
| Impact | Page Cache Corruption |
| Possible Result | Kernel Memory Corruption / Potential LPE |
| Attack Vector | Local |
| Privileges Required | Typically `CAP_NET_ADMIN` |
| Fix Available | ✅ Yes |

---

# 📚 References

- NIST National Vulnerability Database :contentReference[oaicite:6]{index=6}
- Red Hat Security Advisory :contentReference[oaicite:7]{index=7}
- Ubuntu Security Notice :contentReference[oaicite:8]{index=8}

---



### ⭐ Stay Updated

Kernel vulnerabilities evolve rapidly.

Always keep your Linux kernel updated with the latest stable security patches.