CVE-2026-46331

This repository contains a functional exploit for CVE-2026-46331, which leverages a page-cache write primitive in the Linux kernel's tc-pedit module to achieve unprivileged local root access. The exploit overwrites the ELF entry point of a setuid-root su binary in the shared page cache with shellcode, granting root privileges.

This repository contains three functional Linux kernel exploit PoCs for CVE-2026-46331, leveraging page cache corruption via GRO flag loss, skb_shift, and pedit mechanisms to achieve local privilege escalation by overwriting setuid binaries or /etc/passwd.

This repository provides a defensive containment kit for CVE-2026-46331, focusing on hardening Linux systems against a local privilege escalation (LPE) vulnerability in the page cache. It includes scripts for verification, hardening, and detection, along with detailed documentation and testing frameworks for EC2 and Docker environments.

The repository provides a detailed technical analysis of CVE-2026-46331, a Linux kernel local privilege escalation vulnerability in the traffic-control subsystem's act_pedit action. The flaw involves incorrect copy-on-write writable range calculation, allowing unprivileged users to poison cached setuid-root binaries for privilege escalation.

Technical writeup detailing a Linux kernel privilege escalation (LPE) vulnerability in the traffic-control subsystem's `act_pedit` action (CVE-2026-46331). The flaw allows an unprivileged user to exploit a copy-on-write (COW) race condition to overwrite a setuid-root binary in memory, achieving root access without modifying the on-disk file.

This repository contains a weaponized local privilege escalation (LPE) exploit for CVE-2026-46331, leveraging a tc-pedit page-cache write primitive to overwrite the ELF entry point of a setuid-root binary (su) with shellcode. The exploit uses unprivileged user+net namespaces to gain CAP_NET_ADMIN and achieve root access.

This repository contains a functional local privilege escalation (LPE) exploit for CVE-2026-46331, leveraging a tc-pedit page-cache write primitive to overwrite ELF metadata of a setuid-root binary with shellcode, achieving unprivileged root access. The exploit uses user+net namespaces to obtain CAP_NET_ADMIN and targets kernels v5.18 to v7.1-rc6.

This PoC exploits a Linux kernel vulnerability (CVE-2026-46331) in the net/sched act_pedit module, causing partial COW page cache corruption to achieve local privilege escalation. The exploit uses crafted netlink messages to manipulate packet editing (pedit) actions and trigger memory corruption.

The repository provides a detailed technical analysis of CVE-2026-46331, a Linux kernel privilege escalation vulnerability in the `act_pedit` module. It includes before/after patch code snippets demonstrating the root cause (incorrect COW range calculation) and mitigation.

This repository contains detailed technical reports analyzing CVE-2026-46331, a Linux kernel local privilege escalation (LPE) vulnerability in the `act_pedit` module. The reports focus on Copy-on-Write (COW) behavior, auditd telemetry, AppArmor mitigation, and detection logic, but do not include exploit code.

This repository contains a defensive validation report for CVE-2026-46331, focusing on Linux kernel `act_pedit` local privilege escalation behavior, auditd telemetry, and AppArmor mitigation. It includes PDF reports in English and Polish but no functional exploit code.

This repository contains diagnostic and mitigation scripts for CVE-2026-46331, a Linux kernel local privilege escalation vulnerability. The scripts check kernel configurations and apply temporary mitigations but do not include exploit code.

This repository contains a read-only audit script for CVE-2026-46331, which checks for the presence of the vulnerability in the Linux kernel's net/sched act_pedit action. It does not exploit the vulnerability but scans for conditions that indicate potential exposure.

This repository contains a functional exploit for CVE-2026-46331, a Linux kernel local privilege escalation vulnerability. The exploit leverages packet crafting to trigger a page cache corruption via malformed UDP packets, leading to arbitrary code execution with root privileges.

This repository contains a technical writeup describing CVE-2026-46331, a Linux kernel vulnerability in the net/sched subsystem where incorrect COW handling in tcf_pedit_act() leads to page cache corruption. The writeup details the root cause and fix but does not include functional exploit code.

The repository lacks actual exploit code or technical details about CVE-2026-46331, instead providing generic setup instructions and a script to download external content. The README is filled with disclaimers and ethical use statements but no substantive vulnerability analysis.

This repository contains a functional local privilege escalation (LPE) exploit for CVE-2026-46331, targeting a Linux kernel vulnerability in the net/sched act_pedit subsystem due to incorrect Copy-on-Write (COW) handling. The exploit leverages traffic control (tc) packet editing to trigger page cache corruption, potentially leading to privilege escalation.

This repository contains a functional exploit for CVE-2026-46331, a local privilege escalation vulnerability in the Linux kernel. The exploit leverages a page-cache overwrite primitive via tc-pedit actions to corrupt the ELF entry point of a setuid-root binary (e.g., su), achieving root access from an unprivileged user.