CVE-2026-46331 User Namespace CAP_NET_ADMIN Abuse for act_pedit LPE

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•0

This rule detects potential container escape attempts utilizing Linux system calls such as 'unshare' or 'clone' with flags indicative of namespace manipulation (CLONE_NEWUSER, CLONE_NEWNET). It also detects the execution of suspected malicious binaries or traffic manipulation tools associated with 'packet_edit_meme' or 'act_pedit' activities, which are common in Linux-based exploitation scenarios.