CVE-2026-46331 pedit COW: Unprivileged Userns Creation Followed by tc/netlink Activity

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•6

Detects a suspicious sequence of events where a non-root user executes the unshare utility to create a new user and network namespace, followed immediately by the execution of the tc (Traffic Control) utility with parameters (ingress, filter, pedit) indicative of network traffic manipulation or potential exploit exploitation within the created namespace.