CVE-2026-46331 pedit COW: /bin/su page cache poisoning for root shell

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•6

Detects execution patterns associated with CVE-2026-46331 (pedit COW exploit), which uses a user namespace unshare operation, followed by tc pedit action abuse to perform page cache poisoning on /bin/su to achieve root privilege escalation. The rule monitors for the exploit binary, unshare namespace creation, tc command interaction, unauthorized root shell spawning by su/sudo, and attempts to clear page caches.