CVE-2026-46331 Unprivileged User Namespace Creation for CAP_NET_ADMIN

Ethan Andrews@eandrews

•updated Jun 26, 2026•4•0•10

Detects the execution of 'unshare' with flags (such as --user/--net or CLONE_NEWUSER/CLONE_NEWNET) by unprivileged users. This behavior is indicative of attempts to gain CAP_NET_ADMIN capabilities within a new namespace, a necessary precursor to exploiting the pedit COW (CVE-2026-46331) vulnerability for privilege escalation.