Date: 2026-06-23
Update: 2026-06-26
NOTE:
All running resources MUST be either patched or have mitigation
in place or affected services disabled by 2026-07-04, 00:00 UTC.
Sites failing to act or respond to requests from the EGI CSIRT team
risk site suspension. [R 98]
CRITICAL risk vulnerability concerning kernel traffic control module “act_pedit”
which can lead to arbitrary code execution in kernel context or a system crash.
EGI SVG ID : EGI-SVG-2026-25
CVE ID : CVE-2026-46331
CVSSv3 Score:
Sites are recommended to update and reboot services that allow shell access by unprivileged users, such as grid worker nodes, or at least apply a mitigation as described below. Fixed kernels are available for several distributions already: please check the references below.
Please apply these mitigation commands on affected hosts while they cannot yet be rebooted with fixed kernels:
modprobe -r act_pedit
cat > /etc/modprobe.d/blacklist-act-pedit.conf <<'EOF'
install act_pedit /bin/false
blacklist act_pedit
EOF
If the modprobe command reports the module being in use,
the host would need to be rebooted as well.
Alternatively, unprivileged network namespaces can be disabled: please see [R 9] for details.
TLP:CLEAR information - Unlimited distribution
https://advisories.egi.eu/Advisory-EGI-SVG-2026-25
https://advisories.egi.eu/Advisory-SVG-CVE-2026-46331
Minor updates may be made without re-distribution to the sites.
This advisory is subject to the Creative Commons licence
https://creativecommons.org/licenses/by/4.0/ and
the EGI (https://www.egi.eu/) Software Vulnerability Group
must be credited. -----------------------------
[R 13] https://errata.rockylinux.org/RLSA-2026:27353 (fix for RL 8)
SVG was alerted to this vulnerability by Laurent Caillat-Vallet (EGI CSIRT)