CVE-2026-46331 pedit COW LPE - act_pedit Exploit Activity Detection

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

Detects execution patterns indicative of exploitation attempts against the CVE-2024-1086 Linux kernel vulnerability. The rule identifies suspicious usage of networking tools ('tc' with 'pedit'), namespace manipulation ('unshare'), AppArmor profile bypasses ('aa-exec'), and specific malicious binary names associated with proof-of-concept exploits for this vulnerability.