--- title: pedit COW kernel local privilege escalation vulnerability mitigations description: Mitigations are available in Ubuntu for the "pedit COW" Linux kernel local privilege escalation vulnerability. url: https://canonical.com/blog/pedit-cow-linux-vulnerability-fixes-available?format=md --- 1. [Blog](https://canonical.com/blog) 2. Article --- [Luci Stanescu](https://canonical.com/blog/author/lucistanescu "More about Luci Stanescu") 1 July 2026 # pedit COW kernel local privilege escalation vulnerability mitigations [Security](https://canonical.com/blog/tag/security) [Vulnerabilities](https://canonical.com/blog/tag/vulnerabilities) --- Share the article Mitigations are available for the Linux vulnerability with CVE ID [CVE-2026-46331](https://ubuntu.com/security/CVE-2026-46331). The CVE ID was assigned on June 16 2026 and highlighted as a local privilege escalation (LPE) vulnerability on June 26, 2026. Known as “pedit COW”, this vulnerability affects multiple Linux distributions, including all Ubuntu releases starting with Bionic Beaver 18.04 LTS. Ubuntu Resolute Raccoon 26.04 LTS has AppArmor mitigations that block the execution path of the vulnerability. The vulnerability was assigned a CVSS 3.1 score of 7.8, corresponding to a severity of HIGH, on June 28, 2026. The affected component is a Linux kernel module that provides support for [tc-pedit](https://manpages.ubuntu.com/manpages/resolute/man8/tc-pedit.8.html), an action used by the [traffic control](https://manpages.ubuntu.com/manpages/resolute/man8/tc.8.html) subsystem in Linux that allows for arbitrary packet modification. This post describes mitigations that disable the affected modules, if they are not needed by a host. These mitigations can be applied until Linux kernel packages which implement the proposed patch are released. ## Impact ### Deployments without container workloads On hosts that do not run container workloads, the vulnerability allows a local user to elevate privileges to the root user. There is a published exploit that executes in this type of deployment. ### Container deployments In container deployments that may execute arbitrary third-party workloads, the vulnerability may additionally facilitate container escape scenarios, in addition to local privilege escalation on the host. A proof-of-concept exploit has not been published yet for container escape. ## Mitigation regression risk The mitigation disables the kernel modules that are used for the pedit action in tc. Enabling the mitigation will affect functionality if the module is in use by local traffic control rules. ## Affected releases Once available, the vulnerability fix will be distributed through the Linux kernel image packages. In the interim, a mitigation which disables the affected modules can be applied according to the instructions below. The mitigation will not be necessary once the kernel is updated. | | | | | --- | --- | --- | | **Release** | **Package Name** | **Remediation Status** | | Trusty Tahr (14.04 LTS) | linux | Not affected | | Xenial Xerus (16.04 LTS) | linux | Not affected | | Bionic Beaver (18.04 LTS) | linux | Affected | | Focal Fossa (20.04 LTS) | linux | Affected | | Jammy Jellyfish (22.04 LTS) | linux | Affected | | Noble Numbat (24.04 LTS) | linux | Affected | | Questing Quokka (25.10) | linux | Affected | | Resolute Raccoon (26.04 LTS) | linux | AppArmor mitigations | ## How to check if you are impacted Run the following command to obtain the name of the Ubuntu release installed and compare to the table above: ``` lsb_release -a ``` ## Manual mitigation The mitigations block the affected kernel module from loading. This requires three steps: 1. Prevent the module from loading in the future. 2. Unload the module. 3. Check whether step 2 was successful; if not, reboot the system. ### Step 1 – block the module: Block the module by creating a `/etc/modprobe.d/pedit-cow.conf` file: ``` echo "install act_pedit /bin/false" | sudo tee /etc/modprobe.d/pedit-cow.conf ``` Regenerate the initramfs images, to prevent the module from being loaded during early boot: ``` sudo update-initramfs -u -k all ``` ### Step 2 – unload module: Unload the module, in case it is already loaded: ``` sudo rmmod act_pedit 2>/dev/null ``` ### Step 3 – confirm the module isn’t loaded: Check whether the module is still loaded: ``` grep -qE '^act_pedit ' /proc/modules && echo "Affected module is loaded" || echo "Affected module is NOT loaded" ``` If the previous action indicates that the module is not loaded, no further action is required. However, unloading the module may not be possible if it is in use by existing traffic control rules. In these instances, a system reboot will enforce its blocking, but will affect traffic control rules: ``` sudo reboot ``` ## Disabling the mitigation Once kernel updates are available and installed, the mitigation can be removed: ``` sudo rm /etc/modprobe.d/pedit-cow.conf sudo update-initramfs -u -k all ``` [Get in touch Interested in running Ubuntu in your organization?](https://ubuntu.com/about/contact-us/form) ## Sign up for our newsletter Get the latest Canonical news and updates in your inbox. Work email: \*I agree to receive information about Canonical's products and services. By submitting this form, I confirm that I have read and agree to [Canonical's Privacy Policy](https://canonical.com/legal/dataprivacy). Sign up ## Share on --- ## Related posts [### Januscape vulnerability CVE-2026-53359 mitigations available](https://canonical.com/blog/januscape-linux-vulnerability-mitigations-available) Introduction A local privilege escalation (LPE) vulnerability affecting the Linux kernel was publicly disclosed on July 6, 2026. The vulnerability was assigned CVE ID... [seth-arnold](https://canonical.com/blog/author/seth-arnold) 11 July 2026 [### DirtyClone Linux kernel local privilege escalation vulnerability fixes available](https://canonical.com/blog/dirtyclone-linux-vulnerability-fixes-available) On June 25, 2026, JFrog published their research into CVE-2026-43503, referring to the vulnerability as DirtyClone. The vulnerability had previously been responsibly disclosed... [Luci Stanescu](https://canonical.com/blog/author/lucistanescu) 1 July 2026 [### PinTheft Linux kernel vulnerability mitigation](https://canonical.com/blog/pintheft-linux-kernel-vulnerability-mitigation) A local privilege escalation (LPE) security vulnerability in the Linux kernel, codename “PinTheft,” was publicly disclosed on May 19, 2026. The vulnerability was fixed in the... [seth-arnold](https://canonical.com/blog/author/seth-arnold) 21 May 2026 [### CVE-2026-46333 (ssh-keysign-pwn) Linux kernel vulnerability mitigations](https://canonical.com/blog/ssh-keysign-pwn-linux-vulnerability-fixes-available) An information disclosure security vulnerability in the Linux kernel was publicly disclosed on May 15th, 2026. The vulnerability was reported by Qualys and fixed in the... [Luci Stanescu](https://canonical.com/blog/author/lucistanescu) 19 May 2026