CVE-2026-46331 pedit COW: Unprivileged Root Escalation via /bin/su Page Cache Poisoning

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•2

Detects the spawning of root shells from suid binaries (su) in conjunction with user namespace creation or suspicious parent process execution, potentially indicating exploitation of local privilege escalation vulnerabilities like the pedit COW page cache poisoning (CVE-2026-46331). The detection correlates non-root process activity in suspicious locations with subsequent elevated shell creation.