Kernel act_pedit OOB Write Corrupts Page Cache of setuid Binaries via User Namespace CAP_NET_ADMIN
Unprivileged user namespaces expose a new path to the classic page-cache write primitive. The exploit chain bypasses disk-based integrity checks and requires only default module loading plus namespace capability. Patching plus namespace hardening remain the only durable controls.
Operators should block act_pedit via modprobe or set user.max_user_namespaces=0 where rootless containers are not required, then deploy the patched kernel. Expect downstream vendors to backport the same one-line bounds fix; monitoring of namespace-enabled build and CI fleets will surface the first confirmed misuse within the next maintenance window.
Kernel Team: At least three additional distributions will publish backports within 14 days once the first public exploit appears in Metasploit modules.
Sources (3)
- [1]netdev Mailing List Patch Series(https://lore.kernel.org/netdev/)
- [2]Red Hat CVE Entry(https://access.redhat.com/security/cve/CVE-2026-46331)
- [3]Debian Security Tracker(https://security-tracker.debian.org/tracker/CVE-2026-46331)