CVE-2026-46331 pedit COW: act_pedit tc exploitation chain for Linux privilege escalation
This rule detects a multi-stage Linux privilege escalation exploitation sequence often associated with kernel vulnerabilities (such as CVE-2023-32233). It identifies: 1) The creation of a user namespace to acquire CAP_NET_ADMIN privileges, 2) The use of 'tc' (traffic control) with 'pedit' actions by a non-root user, 3) The loading of the 'act_pedit' kernel module by a non-root user, 4) Execution of known proof-of-concept binaries (e.g., PACKET_EDIT_MEME, pedit_cow_demo), and 5) Post-exploit evidence cleanup involving the clearing of system page caches via 'drop_caches'.
Splunk (SPL)
