Linux Kernel `act_pedit` Flaw Enables Local Privilege Escalation on RHEL Systems

Red Hat disclosed CVE-2026-46331, an important local privilege escalation vulnerability in the Linux kernel’s traffic control subsystem, specifically the act_pedit module. The flaw stems from a missing bounds check in tcf_pedit_act() that can lead to an out-of-bounds write and page cache memory corruption, potentially allowing a local user to gain root privileges. Red Hat said RHEL 8, 9, and 10 are directly affected, along with Red Hat Enterprise Linux for NVIDIA and Red Hat OpenShift Container Platform, though OpenShift exposure is considered low because the vulnerable module is not loaded by default.

Technical details show the bug arises when packet-editing keys recompute Layer 4 offsets during processing, allowing an earlier mutation to influence a later write beyond the originally validated writable packet range. Red Hat has issued fixes across multiple product lines, including RHEL variants, SAP Solutions, Telecommunications Update Service, Extended Update Support, Advanced Mission Critical Update Support, and NVIDIA for RHEL 10, while warning that products built on the RHEL kernel such as RHEL CoreOS, Red Hat OpenStack Platform, and Red Hat Virtualization may also be impacted. As a mitigation, Red Hat advised administrators to blacklist the act_pedit kernel module and verify whether it is loaded before unloading it or rebooting.