CVE-2026-46331 /bin/sh Root Shell Spawn via Poisoned /bin/su (pedit COW)

Ethan Andrews@eandrews

•updated Jun 26, 2026•2•0•5

Detects the execution of a /bin/sh root shell initiated by /bin/su where the parent process indicates a non-root context. This pattern is characteristic of CVE-2026-46331, where an attacker exploits the page cache (pedit COW) to inject shellcode into the in-memory cached /bin/su binary, effectively gaining root privileges without on-disk modification.