Two Linux Kernel LPEs Chain With Amazon Q IDE Credential Theft

What Happened

Two unrelated Linux kernel local privilege escalation bugs now ship with public working exploits and no patch behind them. CVE-2026-46331, the one people are calling 'pedit COW', is an out-of-bounds write in the kernel's act_pedit traffic control subsystem. DirtyClone abuses packet cloning logic. JFrog put up a full DirtyClone walkthrough on June 25. It is detailed enough to reproduce.

Both sit in networking-adjacent kernel code paths. That matters because those are the subsystems running on container hosts, Kubernetes nodes, and multi-tenant infrastructure. JFrog's 'DirtyFrag family' label reads like more variants are being held or sequenced.

Why This Is Different

Local privilege escalation normally waits in line behind remote code execution. That math breaks once you assume initial access, and right now you should. The Amazon Q Developer flaw hands attackers code execution on a developer workstation through a malicious repo. PTC Windchill's KEV-listed RCE hands them a shell on an application server. SharkLoader drops Cobalt Strike Beacon through a fresh delivery mechanism that existing loader detections won't match.

The order to work the queue is Linux, Windchill, Q. The order an attacker will work it is the same.

Any of those three initial-access paths leaves an attacker one LPE short of root. COW-class bugs are back, a decade after the original Dirty COW, and the exploit surface is every Linux kernel running in production.

Immediate Mitigations

No patch means hardening is the only move:

• Disable unprivileged user namespaces (kernel.unprivileged_userns_clone=0). This is the prerequisite for most container-escape scenarios that lean on these bugs.
• Restrict CAP_NET_ADMIN hard. pedit COW needs either CAP_NET_ADMIN in a namespace or local unprivileged access to traffic control.
• Add EDR rules for anomalous tc/netlink activity from non-root processes.
• Inventory every kernel version across production, CI runners, K8s nodes, and developer hosts. Stage patches the moment they land upstream.

The DirtyFrag naming says this cluster is not finished. Expect more disclosures in this code area over the coming weeks.

Two Converging Failures

Start with Amazon Q Developer. The flaw is high-severity. A developer opens a malicious repository, the AI assistant ingests attacker-controlled instructions hidden in the project, and AWS credentials leave the local environment. This is the canonical MCP-era supply-chain attack: indirect prompt injection across the trust boundary between repository content and AI agent instructions.

Then the production side. Three applications built primarily with AI code generation breached this cycle. Moltbook leaked 1.5 million auth tokens; the builder reportedly never wrote a line of code. Tea App exposed 72,000 government IDs through an unauthenticated database. A journalist hit RCE on her own machine via a game she vibe-coded. The shared failure is OWASP Top 10 basics: hardcoded secrets, broken access control, IDOR. None of it is novel.

The Pattern

AI coding assistants are running two roles at once:

• Attack vectors — Q, Copilot, Cursor, Cline all interpret repository content as instructions, with reachability to cloud credentials, SSH keys, and environment variables
• Vulnerability generators — optimizing for working features without modeling what those features expose when live, producing code that passes unit tests and fails adversarial testing

Most SOCs carry no detections for either. The IDE is now an execution context. The code review process was built for human-authored code where the reviewer understands the auth model. Neither assumption holds here.

The existing review stack is demonstrably blind to the class of bug shipping the breaches. Either an adversarial gate gets added before deploy, or the next incident report writes itself.

The Market Response

Strix is an open-source AI pentesting agent: 26K+ GitHub stars, 600+ verified vulnerabilities including assigned CVEs across 200 real targets. It automates the dynamic testing these failures need. It crawls routes and probes abuse paths, then returns PoCs with suggested fixes. Whether it generalizes to a given codebase is testable. It is also more evidence than most commercial DAST vendors ship with.

The structural mismatch is the point. The $50K point-in-time pentest model cannot cover code generated at prompt-to-production velocity. The breach record this cycle is what that gap looks like in production.