pedit COW kernel local privilege escalation vulnerability mitigations

Mitigations are available for the Linux vulnerability with CVE ID CVE-2026-46331. The CVE ID was assigned on June 16 2026 and highlighted as a local privilege escalation (LPE) vulnerability on June 26, 2026. Known as “pedit COW”, this vulnerability affects multiple Linux distributions, including all Ubuntu releases starting with Bionic Beaver 18.04 LTS. Ubuntu Resolute Raccoon 26.04 LTS has AppArmor mitigations that block the execution path of the vulnerability.

The vulnerability was assigned a CVSS 3.1 score of 7.8, corresponding to a severity of HIGH, on June 28, 2026.

The affected component is a Linux kernel module that provides support for tc-pedit, an action used by the traffic control subsystem in Linux that allows for arbitrary packet modification.

This post describes mitigations that disable the affected modules, if they are not needed by a host. These mitigations can be applied until Linux kernel packages which implement the proposed patch are released.

Impact

Deployments without container workloads

On hosts that do not run container workloads, the vulnerability allows a local user to elevate privileges to the root user. There is a published exploit that executes in this type of deployment.

Container deployments

In container deployments that may execute arbitrary third-party workloads, the vulnerability may additionally facilitate container escape scenarios, in addition to local privilege escalation on the host. A proof-of-concept exploit has not been published yet for container escape.

Mitigation regression risk

The mitigation disables the kernel modules that are used for the pedit action in tc. Enabling the mitigation will affect functionality if the module is in use by local traffic control rules.

Affected releases

Once available, the vulnerability fix will be distributed through the Linux kernel image packages. In the interim, a mitigation which disables the affected modules can be applied according to the instructions below. The mitigation will not be necessary once the kernel is updated.

Release	Package Name	Remediation Status
Trusty Tahr (14.04 LTS)	linux	Not affected
Xenial Xerus (16.04 LTS)	linux	Not affected
Bionic Beaver (18.04 LTS)	linux	Affected
Focal Fossa (20.04 LTS)	linux	Affected
Jammy Jellyfish (22.04 LTS)	linux	Affected
Noble Numbat (24.04 LTS)	linux	Affected
Questing Quokka (25.10)	linux	Affected
Resolute Raccoon (26.04 LTS)	linux	AppArmor mitigations

How to check if you are impacted

Run the following command to obtain the name of the Ubuntu release installed and compare to the table above:

lsb_release -a

Manual mitigation

The mitigations block the affected kernel module from loading. This requires three steps:

1. Prevent the module from loading in the future.
2. Unload the module.
3. Check whether step 2 was successful; if not, reboot the system.

Step 1 – block the module:

Block the module by creating a /etc/modprobe.d/pedit-cow.conf file:

echo "install act_pedit /bin/false" | sudo tee /etc/modprobe.d/pedit-cow.conf

Regenerate the initramfs images, to prevent the module from being loaded during early boot:

sudo update-initramfs -u -k all

Step 2 – unload module:

Unload the module, in case it is already loaded:

sudo rmmod act_pedit 2>/dev/null 

Step 3 – confirm the module isn’t loaded:

Check whether the module is still loaded:

grep -qE '^act_pedit ' /proc/modules && echo "Affected module is loaded" || echo "Affected module is NOT loaded"

If the previous action indicates that the module is not loaded, no further action is required. However, unloading the module may not be possible if it is in use by existing traffic control rules. In these instances, a system reboot will enforce its blocking, but will affect traffic control rules:

sudo reboot

Disabling the mitigation

Once kernel updates are available and installed, the mitigation can be removed:

sudo rm /etc/modprobe.d/pedit-cow.conf
sudo update-initramfs -u -k all