CVE-2026-46331 pedit COW Linux LPE via unshare and tc act_pedit
Detects the use of 'unshare' to create new kernel namespaces or 'tc' (Traffic Control) with specific parameters (pedit) to manipulate packet headers. These tools are often leveraged by adversaries to perform privilege escalation or network redirection/manipulation within a Linux environment.
SentinelOne
