CVE-2026-46331 act_pedit Netlink TC Rule Creation by Non-Root Process

Ethan Andrews@eandrews

•updated Jun 26, 2026•4•0•6

Detects non-root users utilizing the 'tc' or 'ip' utilities to interact with kernel traffic control structures (qdisc/filter/action) specifically involving 'pedit' actions. This activity is a documented prerequisite for exploiting CVE-2026-46331, a vulnerability enabling page cache poisoning and local privilege escalation.