CVE-2026-45257 BUMSRAKETE: Unprivileged SUID Exec or Exploit Staging Artifacts

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects execution and post-exploitation behaviors associated with the BUMSRAKETE exploit, specifically targeting page-cache overwrite privilege escalation (CVE-2026-45257). The rule identifies the presence of malicious binaries, staging artifacts in /tmp, and unprivileged processes spawning shells via SUID binaries (su, passwd) that indicate successful exploitation.