Full Breakdown
Linux Kernel Page-Cache Bugs Enable Unprivileged Local Root Escalation
6/27/2026, 12:08:40 PM
New Privilege-Escalation Bugs Target Traffic-Control and IPsec Paths
In June 2026 two Linux kernel flaws were disclosed that let an unprivileged local user obtain a root shell. CVE-2026-46331, nicknamed “pedit COW”, abuses the traffic-control action act_pedit. CVE-2026-43503, called DirtyClone, exploits a packet-cloning routine used by IPsec. Both bugs corrupt shared page-cache memory, allowing a set-uid binary such as /bin/su to be altered in RAM while the on-disk file remains unchanged.
Mechanism of Page-Cache Corruption
The act_pedit handler is supposed to copy packet-editing data before modification (copy-on-write). It checks the writable range before the final offsets are known; when offsets are resolved at runtime the write lands outside the private copy and overwrites a shared page-cache page that backs a file. DirtyClone drops a safety flag in the helpers that mark a packet’s memory as shared with a file. The missing flag lets the kernel clone a packet containing pages of a privileged binary, route it through a loopback IPsec tunnel, and overwrite the binary’s authentication code during decryption. In both cases the file on disk is untouched, file-integrity tools report no change, and the attacker already holds a root shell. JFrog Security Research published the DirtyClone exploit on 25 June; the vulnerability carries a CVSS 8.8 rating.
Affected Distributions
The proof-of-concept succeeded on RHEL 10 and Debian 13 (trixie) where unprivileged user namespaces are enabled by default. Ubuntu 24.04 and later restrict namespace creation via AppArmor, but the kernel remains vulnerable. As of 25 June, Ubuntu lists releases 18.04 through 26.04 as vulnerable; Debian 11 and 12 are still listed as vulnerable; Red Hat lists RHEL 8, 9, 10 as affected while RHEL 7 is omitted. The DirtyClone exploit was confirmed on Debian, Ubuntu, and Fedora systems with default namespace configurations.
Vendor Patches and Immediate Mitigations
Red Hat rates CVE-2026-46331 as “important”. Debian back-ported a fix for trixie; Ubuntu, SUSE and other vendors have issued advisories; Red Hat tracks the issue via Bugzilla. The upstream fix landed in Linux v7.1-rc5 on 21 May and has been back-ported to stable and LTS branches. Where immediate patching is not possible, two mitigations are recommended: (1) block the act_pedit module, e.g. `echo 'install act_pedit /bin/true' | sudo tee /etc/modprobe.d/disable-act_pedit.conf`; (2) disable unprivileged user namespaces (`user.max_user_namespaces=0` on RHEL, `kernel.unprivileged_userns_clone=0` on Debian/Ubuntu). Disabling namespaces may break root-less containers, CI sandboxes, and sandboxed browsers. Dropping the page cache (`echo 3 > /proc/sys/vm/drop_caches`) clears the poisoned in-memory copy but does not terminate an already opened root shell.
Criticism of Disclosure Timing
The exploit appeared within a day of the CVE assignment on 16 June, while the underlying patch had been public on the netdev mailing list since late May without a security advisory. Analysts note that waiting for a scanner rule or CVE issuance proved too slow for this class of page-cache corruption bugs, exposing a gap between upstream code publication and coordinated vendor notification.
Conflicting Reports and Gaps
Vendor advisories differ on the status of older releases: Debian 11/12 remain listed as vulnerable, Ubuntu’s AppArmor blocks the default exploit path but does not patch the kernel, and Red Hat omits RHEL 7 from its bulletin. The “DirtyFrag” family remains incompletely audited; any function that moves fragment descriptors without propagating the shared-frag flag could constitute a new CVE, as highlighted by researcher Hyunwoo Kim.
Outlook
Auditing all code paths that manipulate `skb_shinfo()->flags` is recommended to prevent further flag-dropping bugs. Continued back-porting of the May 21 upstream fix, combined with distribution-level hardening of user-namespace creation and module loading, will reduce the attack surface on multi-tenant hosts, CI/CD runners, and Kubernetes nodes. Monitoring for additional page-cache corruption patterns remains a priority for kernel security teams.
