CVE-2026-46331 pedit COW: Non-Root Process UID 0 Transition via /bin/su

Ethan Andrews@eandrews

•updated Jun 26, 2026•2•0•4

Detects anomalous process execution where a non-privileged user attempts to execute /bin/su to transition to UID 0 (root) without a legitimate parent process (such as sudo, sshd, or login). This activity is indicative of the pedit COW (CVE-2026-46331) exploit, which involves poisoning the /bin/su page cache to achieve unauthorized privilege escalation via shellcode injection.