CVE-2026-46331 pedit COW: /bin/su spawning root shell from unprivileged parent

Ibrahim Saud@tektrix

•updated Jun 26, 2026•1•0•3

Detects a potential privilege escalation attempt where an unprivileged user executes a SUID-capable binary (su, sudo, passwd), followed immediately by the creation of a root-owned shell process. This pattern is indicative of exploitation of local privilege escalation vulnerabilities, such as page cache poisoning (e.g., CVE-2026-46331).