Linux Kernel Flaws - DirtyClone and “pedit COW”

Two Linux kernel flaws have been announced:

• DirtyClone CVE-2026-43503 (CVSS 8.8) is a new Linux kernel privilege escalation in the DirtyFrag family.  
• CVE-2026-46331, nicknamed "pedit COW," is a flaw in the Linux kernel's traffic-control subsystem.

These Linux kernel flaws present critical security risks to vulnerable Linux systems.

• The DirtyClone kernel flaw enables local users to gain root access through a cloned network packet. A public demonstration of the exploit has been published.
• The “pedit COW” kernel flaw allows a local unprivileged user to gain root access on affected systems. A public, working exploit was published on June 16.

These vulnerabilities allow unauthorized users to gain full administrative (root) control of a system, which presents critical security risks to all vulnerable Linux systems.

Anyone who runs or administers Linux systems must take action immediately. The need for immediate action supersedes the remediation timeframes in Vulnerability Management (DS-21).

Patch for DirtyClone Kernel Flaw

Install your distribution's kernel update. The patch is available in v7.1-rc5 and has been backported to stable and LTS branches. View the list of fixes available per vendor.

If it is impossible to apply the patch today, apply one of the two mitigations below as a temporary control until you can apply the patch:

• Restrict unprivileged user namespaces: on Debian and Ubuntu, set kernel.unprivileged_userns_clone=0 (other distributions use different mechanisms).
• Alternatively, blacklist the esp4, esp6, and rxrpc kernel modules. Note: this breaks IPsec and AFS and only works when those features are loadable modules rather than compiled into the kernel.

pedit COW

Install your distribution's kernel update as soon as it is available. Consult your vendor for the most current fix availability information. As of 6/25/26, the following information is available:

• Debian has fixed trixie through its security channel. Debian 11 and 12 are still listed as vulnerable.
• Ubuntu lists supported releases from 18.04 through 26.04 as vulnerable (as of June 25).
• Red Hat lists RHEL 8, 9, and 10 as affected; RHEL 7 is not listed in the bulletin.

If you are unable to apply a patch today, apply one of the following temporary mitigations:

• On systems that do not need tc pedit rules, block it from loading:
         echo 'install act_pedit /bin/true' | sudo tee /etc/modprobe.d/disable-act_pedit.conf
  If it is currently loaded in your kernel (lsmod |grep act_pedit) either reboot or manually unload it from the kernel (sudo rmmod act_pedit).
• Alternatively, disable unprivileged user namespaces (user.max_user_namespaces=0 on RHEL, kernel.unprivileged_userns_clone=0 on Debian/Ubuntu). That removes the namespace-local capability the exploit needs, but it breaks rootless containers, some CI sandboxes, and sandboxed browsers. Test first.

DirtyClone

• When the kernel copies a network packet internally, two helper functions drop a safety flag that marks the packet's memory as shared with a file on disk.
• The attacker loads a privileged binary into memory, wires those memory pages into a network packet, and forces the kernel to clone it. The cloned packet passes through an IPsec tunnel that the attacker controls, and the decryption step overwrites the binary's login checks with bytes chosen by the attacker. The next time someone runs the privileged binary, it gives access to the root.
• There is no change to the file on disk because the modification lives in the kernel's in-memory copy. Therefore, file-integrity tools do not detect it and the attack leaves no audit trail. A reboot restores the original binary.

pedit COW

This kernel flaw corrupts shared page-cache memory using an out-of-bounds write in the packet-editing action (act_pedit).

• It corrupts the cached copy of a setuid root binary (/bin/su) in memory, injects a small payload, and runs that altered image as root. There is no change to the file on disk. File-integrity checks do not detect it while a root shell is already open.
• The exploit relies on two things: act_pedit must be loadable and unprivileged user namespaces must be open. The attacker then has the namespace-local networking capability (CAP_NET_ADMIN) needed to trigger the bug. 

ITS provides CrowdStrike Falcon to units, which should be installed on all U-M owned systems (Windows, macOS, and Linux operating systems, whether workstations or servers). Falcon administrators in ITS and in U-M units use the Falcon console to investigate and remediate issues.

Please contact ITS Information Assurance through the ITS Service Center.

• New DirtyClone Linux Kernel Flaw Lets Local Users Gain Root via Cloned Packets (The Hacker News)
• New Linux pedit COW Exploit Enables Root Access by Poisoning Cached Binaries (The Hacker News)