In the Linux kernel

tcf_pedit_act() in net/sched/act_pedit.c precomputes a single COW range using tcfp_off_max_hint and calls skb_ensure_writable() once before the per-key write loop. The hint doesn't include the runtime header offset that *typed* keys add at execution time, so a crafted pedit action writes past the COW'd region into the shared page cache. The end state: an attacker overwrites the in-memory page of a setuid binary (the public exploit targets /bin/su), and the next exec gives them root — all without ever touching the on-disk file. Affected: mainline Linux through June 16 2026, including kernels shipped on RHEL 10 (6.12.0-228.el10), RHEL 9 / 8 backports, Debian 13 (6.12.90+deb13.1), and Ubuntu 24.04.4 (6.17.0-22).

There is no NVD CVSS yet; Red Hat called it *Important*, which is the right neighborhood but underplays the operational reality. A working, author-signed PoC (Massimiliano Oldani, sgkdev/packet_edit_meme) landed within 24 hours of disclosure. It's a clean, deterministic LPE on every default-configured RHEL and Debian box with unprivileged user namespaces — which is most of them. Local-only is the only thing keeping this out of CRITICAL.

Why this verdict

• Public weaponized PoC within 24h of disclosure. sgkdev/packet_edit_meme is a one-shot LPE, not a crash repro. The bar to use it is git clone && make && ./exploit.
• Default-configured exploit surface. RHEL 10 and Debian 13 ship with unprivileged_userns_clone=1 and act_pedit autoloadable — no hardening checkbox to flip first. This is not a niche feature.
• Friction adjustment — local only. AV:L is the one and only thing pulling this off CRITICAL. The attacker must already be on the box (RCE, stolen creds, malicious insider, CI runner). That's a real precondition and it puts the verdict at HIGH, not 10.0.
• Friction adjustment — container default-deny. Docker/Kubernetes default seccomp blocks unshare(CLONE_NEWUSER) from inside a container, so the typical webapp-RCE-in-a-pod path does NOT auto-chain. Shared-tenancy bare-metal and VM hosts have no such gate.
• Role multiplier — multi-tenant Linux (shared dev boxes, jump hosts, bastions, JupyterHub, HPC login nodes, university shells): chain succeeds, blast radius = full host compromise of a host that holds many users' credentials and SSH keys → lateral pivot to dozens of downstream systems. Floor = HIGH.
• Role multiplier — container hosts / Kubernetes worker nodes: if the attacker is *on the node* (not in a pod), chain succeeds and yields node-root → kubelet credentials → cluster-wide pivot. This is a high-value role but reaching the node requires a prior container escape, so it sets the ceiling at HIGH not CRITICAL.
• Role multiplier — single-tenant app servers and developer workstations: chain succeeds; impact is local root on one box. Still HIGH because of pivot potential to credentials cached on that host (cloud SDK keys, kubeconfig, browser cookies).
• No high-value role canonically owned by act_pedit. Unlike a hypervisor or domain controller bug, this is a kernel LPE — the role multiplier doesn't push to a CRITICAL floor because the affected *component* isn't a fleet-control plane on its own.

Why not higher?

CRITICAL requires either remote exploitability or a chain that ends in fleet-scale compromise from a single act. This bug requires a pre-existing local foothold and ends in single-host root. The realistic CVSS tops out around 8.4 with scope-change accounting for page-cache cross-user impact — that's the top of HIGH, not CRITICAL.

Why not lower?

MEDIUM is wrong because there is a public, deterministic, weaponized PoC against default distro configurations and the chain reliably ends in root. EPSS of 0.00291 reflects scanner blindness to LPE bugs, not actual risk. Any environment with shared Linux hosts, CI runners, or untrusted local code (i.e. almost every enterprise) must treat this as urgent.

1. Disable unprivileged user namespaces fleet-wide — Set kernel.unprivileged_userns_clone=0 (Debian/Ubuntu) or user.max_user_namespaces=0 (RHEL) via sysctl drop-in. Kills the namespace-local CAP_NET_ADMIN path that gates the exploit. Deploy within 3 days per noisgate mitigation SLA; verify with Ansible/Salt that the sysctl sticks across reboot. Caveat: breaks rootless Podman, Chrome sandbox, Flatpak — test on a workstation pilot ring first.
2. Blocklist the act_pedit kernel module — Drop install act_pedit /bin/false into /etc/modprobe.d/noisgate-cve-2026-46331.conf and rmmod act_pedit if already loaded. No legitimate workload outside of advanced QoS shaping uses pedit. Deploy within 3 days; verify with modprobe -n -v act_pedit showing the install line.
3. Apply the vendor kernel patch and reboot — Stage RHSA-2026:27288 / 27789 / 27353, DSA-6355-1, and the corresponding Ubuntu USN through your normal kernel-rollout pipeline. Remediation deadline is 90 days per noisgate remediation SLA, but for any multi-tenant host (bastion, jump, dev shell, CI runner) accelerate to 14 days.
4. Enable kpatch / kernel live patching where available — RHEL kpatch and Ubuntu Livepatch both ship this fix as a no-reboot patch. Best path for hosts you cannot reboot inside the 3-day mitigation window.
5. Hunt for prior abuse in audit logs — Search auditd for unshare(CLONE_NEWUSER|CLONE_NEWNET) followed by tc filter add from non-root UIDs in the last 30 days. Any hit on a production host is incident-response material.

Run on each target Linux host as root (or via your config-mgmt agent). Example: sudo ./check-cve-2026-46331.sh. The script checks running kernel version against the patched kernel for the detected distro and reports VULNERABLE / PATCHED / UNKNOWN.

#!/usr/bin/env bash
# noisgate verification: CVE-2026-46331 (net/sched pedit partial COW)
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN
set -u

KVER="$(uname -r)"
DISTRO="unknown"
if [ -r /etc/os-release ]; then
  . /etc/os-release
  DISTRO="${ID:-unknown}"
  DVER="${VERSION_ID:-}"
fi

echo "[noisgate] kernel=$KVER distro=$DISTRO $DVER"

# Helper: compare dotted versions; returns 0 if $1 >= $2
ver_ge() { [ "$(printf '%s\n%s\n' "$2" "$1" | sort -V | tail -1)" = "$1" ]; }

verdict="UNKNOWN"
reason="distro/kernel not in known-patched table"

case "$DISTRO" in
  rhel|centos|almalinux|rocky)
    # RHEL 10: fixed in RHSA-2026:27288 (>= 6.12.0-228.4.el10 or rebuild post-fix)
    # RHEL 9:  fixed in RHSA-2026:27789
    # RHEL 8:  fixed in RHSA-2026:27353
    if echo "$KVER" | grep -q 'el10'; then
      FIXED="6.12.0-228.4.el10"
    elif echo "$KVER" | grep -q 'el9'; then
      FIXED="5.14.0-580.el9"
    elif echo "$KVER" | grep -q 'el8'; then
      FIXED="4.18.0-620.el8"
    else FIXED=""; fi
    if [ -n "$FIXED" ]; then
      RUN="$(echo "$KVER" | sed 's/\.\(x86_64\|aarch64\|ppc64le\|s390x\)$//')"
      if ver_ge "$RUN" "$FIXED"; then verdict="PATCHED"; reason="$RUN >= $FIXED"; else verdict="VULNERABLE"; reason="$RUN < $FIXED"; fi
    fi ;;
  debian)
    # Debian 13: DSA-6355-1, fixed kernel 6.12.90+deb13.2 or later
    FIXED="6.12.90+deb13.2"
    if ver_ge "$KVER" "$FIXED"; then verdict="PATCHED"; reason="$KVER >= $FIXED"; else verdict="VULNERABLE"; reason="$KVER < $FIXED"; fi ;;
  ubuntu)
    # Ubuntu 24.04: USN pending; treat anything < 6.17.0-23 as VULNERABLE
    FIXED="6.17.0-23"
    if ver_ge "$KVER" "$FIXED"; then verdict="PATCHED"; reason="$KVER >= $FIXED"; else verdict="VULNERABLE"; reason="$KVER < $FIXED"; fi ;;
esac

# Mitigation indicators (downgrade VULNERABLE -> MITIGATED-style note)
MITIGATED=0
USERNS="$(sysctl -n kernel.unprivileged_userns_clone 2>/dev/null || echo unknown)"
MAXNS="$(sysctl -n user.max_user_namespaces 2>/dev/null || echo unknown)"
if [ "$USERNS" = "0" ] || [ "$MAXNS" = "0" ]; then MITIGATED=1; fi
if grep -qsE '^(install|blacklist)\s+act_pedit' /etc/modprobe.d/*.conf 2>/dev/null; then MITIGATED=1; fi

echo "[noisgate] verdict=$verdict ($reason)"
echo "[noisgate] unprivileged_userns_clone=$USERNS max_user_namespaces=$MAXNS act_pedit_blocklisted=$( [ $MITIGATED -eq 1 ] && echo yes || echo no )"

case "$verdict" in
  PATCHED)    exit 0 ;;
  VULNERABLE) [ $MITIGATED -eq 1 ] && echo '[noisgate] NOTE: kernel vulnerable but compensating control present'; exit 1 ;;
  *)          exit 2 ;;
esac

Sources

1. Ubuntu Security — CVE-2026-46331
2. TuxCare — pedit-COW analysis
3. Red Hat — RHSA-2026:27704
4. GitHub Advisory GHSA-cr2w-747q-47qc
5. The Hacker News — pedit COW root exploit coverage
6. Mallory vulnerability record
7. PT Security dbugs entry
8. OpenCVE — CVE-2026-46331