CVE-2026-46331

A flaw was found in the Linux kernel's traffic control packet editing (pedit) subsystem. In tcf_pedit_act(), the copy-on-write (COW) range for skb_ensure_writable() is computed once before iterating over edit keys, but the calculation does not account for runtime header offsets added by typed keys. This can leave part of the target write region without a proper copy-on-write, leading to an out-of-bounds write that corrupts page cache memory. A local attacker with the ability to configure traffic control rules could exploit this to escalate privileges or crash the system.

Red Hat rates this flaw as Important severity.

This vulnerability is in the kernel's traffic control (tc) pedit action, which requires CAP_NET_ADMIN capability to configure. By default in Red Hat Enterprise Linux, this limits exploitation to the root user or processes explicitly granted network administration capabilities. However, in some circumstances unprivileged users may obtain CAP_NET_ADMIN within user namespaces. Successful exploitation could lead to arbitrary code execution in kernel context or a system crash.

Red Hat Enterprise Linux 7 and earlier are not affected. Within OpenShift Container Platform, the vulnerable module is not loaded by default, reducing the severity to Low.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, prevent the 'act_pedit' kernel module from loading. Create a file /etc/modprobe.d/disable-act_pedit.conf with the following content:

install act_pedit /bin/true

Then, regenerate the initramfs and reboot the system for the changes to take effect. This may impact network traffic control functionality that relies on the pedit action.