In summary:

This exploit achieves root (local privilege escalation) via exploiting a page-cache corruption vulnerability in the Linux Kernel's Traffic Control (TC) packet editor. (CVE-2026-46331).

It is fixed in v7.1-rc7

Affected Linux Kernels and Distros:

- Any Linux kernel with CONFIG_NET_ACT_PEDIT or CONFIG_USER_NS (all major distros)

- Kernel versions: v5.18 to v7.1-rc6

- Older stable back-ported branches: 4.19.244+, 5.4.195+, 5.10.117+, 5.15.41+, 5.17.9+

- Ubuntu 22/24/26.04, Fedora 43-44, Debian 12-13, RHEL 8-10, AlmaLinux 10 — all vulnerable in default config

Full write up is here: [0]

[0] https://github.com/rjt-gupta/page-cache-corruption-lpes/tree...