CVE-2026-46331 pedit COW Page Cache Poisoning LPE via PACKET_EDIT_MEME

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•0

Detects activities associated with the exploitation of the Netfilter vulnerability CVE-2023-32233. The rule monitors for the compilation or execution of known exploit binaries (e.g., packet_edit_meme), the use of 'unshare' for namespace-based privilege escalation (gaining CAP_NET_ADMIN), the loading of the 'act_pedit' kernel module, and potential AppArmor bypass attempts via 'aa-exec'.