Kernel Security

A trivial u32 integer wraparound in Linux’s TC pedit action allows unprivileged local users to corrupt arbitrary readable files in the page cache, bypassing skb_ensure_writable() protections. Unlike traditional Dirty-class vulnerabilities that target memory, this attack corrupts file-backed pages that can persist across reboots when the kernel writes back polluted cache. It’s a silent, persistent data integrity attack that requires no special permissions and may go undetected until critical data is already compromised.