CVE-2026-46331 pedit COW: Unprivileged User Namespace + tc pedit Exploit Chain
Detects suspicious activity involving the combination of user or network namespace creation using 'unshare' or 'ip' and subsequent manipulation of kernel networking queues using 'tc' (Traffic Control). This behavioral pattern is frequently observed in Linux kernel exploits designed to achieve local privilege escalation by creating namespaces and using the 'tc' subsystem to trigger vulnerabilities. The rule further refines matches by flagging commands or parent processes residing in directories associated with staging or temporary storage, such as /tmp or /dev/shm.
Splunk (SPL)
