CVE-2026-46331 pedit COW Linux Page Cache Poisoning via act_pedit and unshare

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•3

This rule detects command line activity associated with the exploitation of a Linux kernel vulnerability involving packet editing (often referred to as the 'pedit' or 'act_pedit' vulnerability). It monitors for the execution of exploit-specific binaries, kernel module loading of 'act_pedit', use of 'unshare' for namespace abuse, and configuration of 'tc' (traffic control) filters related to the exploit.