CVE-2026-46331 pedit COW AppArmor Bypass via aa-exec Profile Re-exec on Ubuntu

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•3

This rule monitors process execution events for the 'aa-exec' utility, a tool often used in containerized environments (such as AppArmor) or specific runtime configurations, when invoked with specific command-line arguments (-p trinity, -p chrome, or -p flatpak). These patterns are indicative of specialized container or sandbox execution activities that may warrant investigation in specific enterprise environments.