Back to today’s briefing

Story perspectives

Linux “pedit COW” Exploit Gives Root, Ubuntu 26.04 Blocks It

6/27/2026

47 10 Full Breakdown

Summary

Story summary

The CVE-2026-46331 “pedit COW” exploit enables an unprivileged local user to obtain root privileges on vulnerable Linux kernels.
It corrupts the cached copy of /bin/su in memory, runs it as root, and bypasses file-integrity checks.
The exploit works when act_pedit loads and unprivileged user namespaces are enabled, granting CAP_NET_ADMIN.
RHEL 10, Debian 13, and Ubuntu 24.04 are vulnerable, while Ubuntu 26.04 blocks the exploit with AppArmor.

1 of 1

Story summary

The CVE-2026-46331 “pedit COW” exploit enables an unprivileged local user to obtain root privileges on vulnerable Linux kernels.
It corrupts the cached copy of /bin/su in memory, runs it as root, and bypasses file-integrity checks.
The exploit works when act_pedit loads and unprivileged user namespaces are enabled, granting CAP_NET_ADMIN.
RHEL 10, Debian 13, and Ubuntu 24.04 are vulnerable, while Ubuntu 26.04 blocks the exploit with AppArmor.