This exploit achieves root (local privilege escalation) via exploiting a page-cache corruption vulnerability in the Linux Kernel's Traffic Control (TC) packet editor. (CVE-2026-46331).
It is fixed in v7.1-rc7
Affected Linux Kernels and Distros:
- Any Linux kernel with CONFIG_NET_ACT_PEDIT or CONFIG_USER_NS (all major distros)
In summary:
This exploit achieves root (local privilege escalation) via exploiting a page-cache corruption vulnerability in the Linux Kernel's Traffic Control (TC) packet editor. (CVE-2026-46331).
It is fixed in v7.1-rc7
Affected Linux Kernels and Distros:
- Any Linux kernel with CONFIG_NET_ACT_PEDIT or CONFIG_USER_NS (all major distros)
- Kernel versions: v5.18 to v7.1-rc6
- Older stable back-ported branches: 4.19.244+, 5.4.195+, 5.10.117+, 5.15.41+, 5.17.9+
- Ubuntu 22/24/26.04, Fedora 43-44, Debian 12-13, RHEL 8-10, AlmaLinux 10 — all vulnerable in default config
Full write up is here: [0]
[0] https://github.com/rjt-gupta/page-cache-corruption-lpes/tree...