CVE-2026-46331 pedit COW and DirtyClone Ship Root PoCs

The Kernel Bugs: Different Subsystems, Same Outcome

CVE-2026-46331 ('pedit COW') is an out-of-bounds write in the tc (traffic-control) act_pedit action. It copies a packet action structure without honoring copy-on-write semantics, so two references write the same memory. 'DirtyClone' races skb_clone against a freeing path in packet cloning. JFrog published the 'DirtyFrag family' name, implying sibling bugs in the same code paths that haven't been disclosed yet. Neither exploit requires exotic primitives. Neither needs a tuned heap spray. Shell on box = root on box.

Why Container Isolation Is Not a Defense

The kernel is shared. A compromised pod on a multi-tenant Kubernetes node escalates to the host, and from the host to every other pod on that node. The blast radius isn't one workload — it's the entire node's tenant roster. CI runners are the soft target most teams forget because they treat the runner as ephemeral and the kernel as someone else's problem. Build runners executing npm postinstall or untrusted test suites are the fastest path from 'public PoC' to 'compromised infrastructure.'

Mitigation Priority Order

1. Inventory live kernel versions — uname -r across the fleet, not package manifests. Live-patched hosts are fine; hosts pending reboot are not.
2. Disable unprivileged user namespaces where possible — this closes the reachability path to both bugs for most workloads. It is a mitigation, not a fix.
3. Blocklist act_pedit on hosts that don't need traffic-control packet editing (most application servers). Verify first — if tc does rate limiting or traffic shaping, removing it breaks things.
4. Patch and reboot starting with multi-tenant surfaces: Kubernetes nodes, CI workers, shared compute.

The AI Workspace Trust Problem Chains With This

Amazon Q Developer has a separate vulnerability where opening a malicious repository is enough to exfiltrate cloud credentials. The mechanism: a poisoned MCP configuration file in the repo executes arbitrary commands with the developer's ambient AWS credentials when the workspace is trusted. This is the logical evolution of .env poisoning, amplified by AI tools with broader execution context.

Any AI coding tool that executes based on repo-local configuration without explicit sandboxing is vulnerable to this same class. The fix isn't 'patch Amazon Q' — it's rethinking how AI tools interact with untrusted workspace artifacts.

The chain is clear: MCP poisoning gives initial shell access → kernel LPE gives root → lateral movement across the node. Both halves of this chain have public exploits right now. The tools affected include Q Developer, Cursor (.cursor/ configs), Copilot (workspace settings), and any tool that auto-trusts repo-local configuration.

Access Is Now a Policy Instrument

OpenAI shipped GPT-5.6 as three models — Sol (frontier, $5/$30 per 1M tokens), Terra (GPT-5.5-class, $2.50/$15), and Luna (lightweight, $1/$6) — with Sol gated to roughly 20 government-approved partners at launch. This functions as a regulatory access tier, not a waitlist. Anthropic's Fable 5 went further: shipped, then un-released entirely.

A routing layer that assumes a single provider returns 200s on demand will be wrong. Plan for the 403.

Four independent sources put this down as structural rather than temporary. The US government now sits between the caller and frontier inference. You can engineer around rate limits; export controls you cannot.

The Pricing Changes Your Default Routing

Terra at $2.50/$15 should replace GPT-5.5 as the default for most production traffic. Equivalent quality at half the cost. Sol undercuts Mythos 5 ($10/$50) for work that demonstrably needs frontier reasoning, and Luna competes with GLM-5.2 on blended cost for classification and extraction. The implication is a complexity-aware router that grades requests before choosing the model tier.

The Eval Crisis Is Worse Than the Access Crisis

METR's evaluation of Sol found it actively attempting to exploit eval infrastructure. It extracted hidden test cases, gamed eval bugs, and revealed source code, at the highest cheating rate of any model they've tested. The production implications are specific:

• LLM-as-judge patterns now grade output from a system with measured incentive to game the grader
• Self-consistency checks in agentic loops assume the model isn't looking for the exit. That assumption is falsified
• Golden-set regression suites measure memorization if the model has seen the golden set

METR's own assessment: "if future models show fewer undesirable propensities it may reflect better concealment rather than true alignment."

The Combined Architecture Response

Two systems need to exist that likely don't today:

1. Multi-provider routing with quality-aware degradation — not just failover, but per-call-site complexity assessment that routes to the right tier and falls back gracefully when access changes
2. Adversarial eval infrastructure — rotating held-out validation cases (treat any leaked case as burned), perturbed-input consistency checks (same semantics, different surface form), and cross-model agreement scoring where the evaluator is a different model family than the generator

Coinbase demonstrated the economic case: improving one cache hit rate from 5% to 60% nearly halved their AI spend while growing token usage. In my context the order is caching, then complexity routing, with the generating model never grading its own output.