CVE-2026-46331 pedit COW Linux LPE via act_pedit User Namespace Abuse

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•5

This rule detects the use of specific Linux utilities often associated with local privilege escalation or container escape techniques. It monitors for commands involving 'unshare' with flags that allow user or network namespace manipulation, network traffic control ('tc') commands specifically interacting with 'pedit' or 'qdisc' which can be abused for kernel-level manipulation, 'ip netns' commands to manage network namespaces, and execution of known exploit-related filenames like 'pedit_cow_demo' or 'packet_edit_meme'.