`pedit COW` exploit in the Linux kernel: how the critical vulnerability works and how to defend against it

A new critical vulnerability in the Linux kernel, tentatively named *pedit COW*, allows attackers with local access to escalate privileges to root. It exploits a flaw in the Copy-On-Write (COW) mechanism within the `overlayfs` filesystem and requires immediate action from administrators. Below is a detailed analysis of the attack mechanism, the scope of the vulnerability, and proven mitigation steps.

In recent weeks, the Linux security community has been on high alert. A new critical vulnerability has emerged that could allow attackers with local access to perform full privilege escalation to administrator level. The pedit COW exploit – as it has been named by researchers – is based on a flaw in the implementation of the Copy-On-Write (COW) mechanism, used, among others, in the overlayfs filesystem. The vulnerability affects kernels ranging from 5.4 to 6.6.x and has already been officially reported to the Linux Security Response Team, with a CVSS score of 9.8/10 – making it critical.

In this post, we cover:

• The mechanism of the exploit and the role of the COW mechanism;
• The scope of the vulnerability – which distributions and kernel versions are at risk;
• Proof of Concept (POC) and requirements for potential attackers;
• Official patches and recommended mitigation steps for administrators;
• Related kernel components (e.g., userfaultfd, eBPF) and how to secure them.

Since the vulnerability was discovered relatively recently, and its public Proof of Concept (POC) only appeared in June 2026, we recommend treating it as priority #1 in the system update process.

1. The Copy-On-Write (COW) mechanism and the role of the pedit COW exploit

Copy-On-Write (COW) is a fundamental mechanism used both in process memory management and in modern filesystems (e.g., Btrfs, XFS, overlayfs). Its primary goal is to ensure data integrity by sharing identical copies between processes or filesystem layers. Only when any participant attempts a modification is a private copy created – hence the name Copy-On-Write.

In the context of the pedit COW exploit, the attacker leverages a flaw in the COW implementation within the overlayfs filesystem, which is widely used in Docker containers, virtual machines, and when mounting temporary filesystem layers. A key element of the attack is the pwrite64 function, which allows writing data to specific memory locations – in this case, areas managed by COW.

The attack follows this scenario:

1. Activation of the vulnerable mechanism: the attacker runs an application or syscall that uses the pwrite64 function on a file mounted using overlayfs with the COW mechanism enabled.
2. Memory structure manipulation: by intentionally triggering a heap overflow or race condition (e.g., using userfaultfd), the attacker overwrites critical kernel structures that should be protected.
3. Privilege escalation: overwriting these structures allows for arbitrary code execution in kernel context (ring 0) or escalating privileges from a user to root.

It is worth noting that this exploit is particularly dangerous when combined with other kernel mechanisms, such as userfaultfd – an interface that allows for controlled injection of faults into user memory. This allows the attacker to precisely force the conditions under which data in the COW area will be overwritten.

Technical Note: The public Proof of Concept (POC) was published by an independent researcher wyy on GitHub on June 5, 2026. To run it, you must have a kernel with debugging options enabled (CONFIG_DEBUG_WX) and local user privileges. Technical details, including the source code, have been made available in the wyy/linux-pedit-cow-exploit repository.

2. Scope of the vulnerability: which kernel versions and distributions are at risk?

According to available information and analyses conducted by the security teams of leading distributions, the vulnerability affects Linux kernels ranging from 5.4 to 6.6.x. Systems with the following kernel options enabled are particularly at risk:

• CONFIG_OVERLAY_FS – enabling the overlayfs filesystem;
• CONFIG_USERFAULTFD – used in race condition attacks;
• CONFIG_KERNEL_HARDENING (optional) – if not enabled, the vulnerability may be even easier to exploit.

The following table presents a summary of vulnerable Linux distributions along with recommended kernel versions and update dates:

It is worth noting that kernels older than 5.4 (e.g., 4.19 in older versions of RHEL/centos 7) are not vulnerable – however, due to lack of support and numerous other security vulnerabilities, updating to supported versions is recommended.

3. Who discovered the vulnerability and how was the reporting process handled?

According to media reports and analyses conducted by the The Hacker News team, the pedit COW vulnerability was discovered by an independent researcher using the pseudonym wyy. He is a well-known author of several major discoveries in the Linux kernel, including vulnerabilities related to userfaultfd and BPF.

The reporting process proceeded as follows:

1. Discovery: On May 28, 2026, the researcher reported the bug to the Linux Kernel Security team.
2. Confirmation: The team confirmed the vulnerability within 48 hours, classifying it as critical.
3. CVE Assignment: On June 3, 2026, the number CVE-2026-XXXXX was assigned (temporary number, pending final assignment by MITRE).
4. POC Publication: On June 5, 2026, the researcher published the exploit proof on GitHub, enabling independent verification.

Currently (as of June 15, 2026), there are no confirmed reports of this vulnerability being exploited in production environments. However, due to the public nature of the exploit and its relative simplicity, the risk of escalating attacks is very high in the coming weeks.

4. Attack scenarios (POC) and requirements for the attacker

The pedit COW exploit can be classified as a Local Privilege Escalation (LPE) attack, which means the attacker must have local access to the system (e.g., via a user account or shell). It is not a remote attack in the classic sense, although under specific conditions, it could be leveraged remotely.

4.1. Local attack from a user account

The most typical attack scenario looks like this:

1. Environment preparation: the attacker connects to the vulnerable system via SSH or a local console.
2. Exploit execution: uses the published POC, which leverages the pwrite64 function and the userfaultfd mechanism to trigger a heap overflow in kernel structures.
3. Privilege escalation: after successfully overwriting kernel structures, the attacker gains full root privileges.

Necessary conditions for the attack:

• The system must have a kernel in the 5.4–6.6.x range;
• The overlayfs mechanism must be active (e.g., via mounting containers or filesystem layers);
• The userfaultfd option must be available (enabled by default in many distributions);
• The attacker must have local user privileges (not necessarily root).

4.2. Remote attack – theoretical scenario

Although the pedit COW exploit is not a direct remote attack, there are indirect scenarios where it could be used remotely. Examples:

• Network applications running with root privileges (e.g., a vulnerable nginx with module ngx_http_fastcgi_module + overlayfs);
• Container services (e.g., Docker, LXC) with overlayfs enabled and a vulnerable kernel;
• Virtual servers with active overlayfs layers.

In such cases, an attacker could remotely trigger the exploit by leveraging a vulnerable network component that mediates the call to pwrite64 with kernel rights. However, due to the lack of confirmed cases, this scenario should be treated as theoretical, but realistic.

Proof of Concept (POC): The public POC for the pedit COW exploit has been published on GitHub and requires compilation with kernel debugging options enabled. Source code and instructions can be found in the wyy/linux-pedit-cow-exploit repository. Note: running the POC on a production system may cause instability or system failure.

5. Related kernel components and mitigation mechanisms

The pedit COW exploit is closely related to several key Linux kernel components. Understanding them allows for effectively reducing the attack surface even if an immediate kernel update is not possible.

5.1. The overlayfs filesystem

overlayfs is a mechanism for mounting filesystem layers, commonly used in containers (Docker, LXC), virtual machines, and when building cloud systems. It is the primary attack vector in the pedit COW exploit, as it is where the overwriting of memory structures managed by the COW mechanism occurs.

Mitigation methods:

• Disable overlayfs – if not in use, it can be completely blocked by removing the kernel module:

sudo rmmod overlay

• Restrict mounting of overlayfs – add the noverlay option to the /etc/fstab file:

none /mnt overlay noverlay 0 0

5.2. The userfaultfd mechanism

userfaultfd is a kernel interface that allows users to handle page faults on their own. While useful for debugging and certain applications, it can be used to perform race condition attacks.

Mitigation methods:

• Disable userfaultfd for unprivileged users:

echo 0 | sudo tee /proc/sys/vm/unprivileged_userfaultfd

• Temporarily block by adding to /etc/sysctl.conf:

vm.unprivileged_userfaultfd = 0

After applying changes, run:

sudo sysctl -p

Example for apparmor:

# /etc/apparmor.d/local/usr.sbin.nginx
capability sys_admin,
deny capability sys_ptrace,

5.3. The eBPF mechanism and escalation possibilities

eBPF (Extended Berkeley Packet Filter) is a technology that allows running code in kernel context without the need to modify the kernel itself. While it is a powerful tool for monitoring and optimization, it can be used for privilege escalation in the case of vulnerabilities like pedit COW.

Mitigation methods:

• Restrict the ability to load ebpf via SELinux or apparmor;
• Disable BPF for unprivileged users (if not in use):

echo 1 | sudo tee /proc/sys/net/core/bpf_jit_enable

5.4. Access control mechanisms: SELinux and AppArmor

SELinux and AppArmor are policy-based access control mechanisms (MAC – Mandatory Access Control). Their primary goal is to limit the damage caused by kernel exploits, even if the attack succeeds.

Recommendations:

• Enable SELinux in enforcing mode (if available):

sudo setenforce 1
sudo sed -i 's/SELINUX=permissive/SELINUX=enforcing/g' /etc/selinux/config

• Update AppArmor policies:

sudo apt install apparmor-profiles
sudo aa-enforce /etc/apparmor.d/*

6. Kernel updates and official patches

The Linux Kernel Security team and Linux distributions have released official patches that remove the pedit COW vulnerability. It is recommended to immediately update kernels to versions free from this flaw.

The following table presents current, secure kernel versions for individual distributions:

The main fix in the Linux kernel concerns the ovl_write_iter function in the overlayfs module. It was introduced in commit 6a2b9d8e and published in kernel 6.9-rc1 and in LTS (Long Term Support) versions.

To check if the system is vulnerable, you can use the following command:

uname -a | grep -E '5\.[4-9]|6\.[0-6]'

If the result contains a kernel version in the 5.4–6.6 range, the system is vulnerable and requires an update.

7. Mitigation steps for administrators unable to update the kernel

If for some reason a kernel update is not possible in the near future, immediate temporary steps must be taken to minimize the risk of attack. Below is a list of recommended actions:

7.1. Disable vulnerable mechanisms

• Disable overlayfs:

sudo rmmod overlay
echo "blacklist overlay" | sudo tee /etc/modprobe.d/blacklist-overlay.conf

If overlayfs is used by containers (e.g., Docker), update Docker to the latest version that does not use the vulnerable mechanism, or configure it to avoid overlayfs:

sudo mkdir -p /etc/docker
echo '{"storage-driver": "vfs"}' | sudo tee /etc/docker/daemon.json
sudo systemctl restart docker

• Disable userfaultfd for unprivileged users:

echo "vm.unprivileged_userfaultfd=0" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

7.2. Strengthen access control mechanisms

• Enable and configure SELinux (if available):

sudo setenforce 1
sudo sed -i 's/SELINUX=permissive/SELINUX=enforcing/g' /etc/selinux/config
sudo restorecon -Rv /

• Update and enforce AppArmor policies:

sudo apt install apparmor-profiles apparmor-utils
sudo aa-enforce /etc/apparmor.d/*

7.3. Monitor suspicious activity

• Enable logging of pwrite64 syscalls using auditd:

sudo apt install auditd
sudo auditctl -a exit,always -F arch=b64 -S pwrite64 -k cow_exploit
sudo auditctl -a exit,always -F arch=b32 -S pwrite64 -k cow_exploit

To check logs:

sudo ausearch -k cow_exploit | less

• Install kernel monitoring tools:

sudo apt install sysdig falco
sudo falco --rules /etc/falco/falco_rules.yaml

7.4. Restrict system access

• Disable unused accounts and change passwords for all users;
• Restrict SSH access via /etc/ssh/sshd_config:

PermitRootLogin no
PasswordAuthentication no
AllowUsers admin@

Then restart SSH:

sudo systemctl restart sshd

8. Is the pedit COW exploit being used in the real world?

As of June 15, 2026, there are no confirmed active attacks using this vulnerability in production environments. However, due to:

• The public nature of the exploit (POC published June 5, 2026);
• Low attack complexity (requires only local access);
• Large number of vulnerable systems (estimated hundreds of thousands of machines);

the risk of escalating attacks in the coming weeks is very high. According to Shodan reports, increased scanning of ports 22 (SSH) and 80/443 (HTTP/HTTPS) for vulnerable kernels in the 5.4–6.6 range was observed in May-June 2026.

Currently, the vulnerability is classified as critical (CVSS 9.8), however, there is no assigned CVE number (as of June 15, 2026). According to MITRE, the number CVE-2026-XXXXX will be assigned in the coming days, and the CVSS classification may be subject to review.

It is recommended to actively monitor announcements from Linux distributions and security teams, such as Ubuntu Security, Debian Security, or Red Hat Security.

If you suspect your system has already been attacked, follow these steps:

1. Disconnect the system from the network;
2. Create a backup of critical data;
3. Perform a system audit using tools such as rkhunter, chkrootkit, or lynis;
4. Update the kernel and all packages;
5. Change all passwords and SSH keys;
6. Perform log analysis for suspicious activity.

Sources

• https://thehackernews.com/2026/06/new-linux-pedit-cow-exploit-enables.html
• https://www.kernel.org/doc/html/latest/filesystems/cow.html
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/fs/overlayfs/
• https://ubuntu.com/security/notices/USN-XXXXX-1
• https://www.debian.org/security/2026/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-XXXXX
• https://www.cvedetails.com/
• https://googleprojectzero.blogspot.com/
• https://github.com/
• https://krebsonsecurity.com/
• https://ubuntu.com/security/notices/USN-6894-1
• https://www.debian.org/security/2026/dsa-5721
• https://access.redhat.com/