CVE-2026-46331 pedit COW Full Exploit Chain: Userns + act_pedit + Setuid Binary Access
Detects a sequence of events characteristic of a privilege escalation exploit (referenced as CVE-2026-46331). The chain involves an unprivileged user creating a user namespace, followed by the configuration of traffic-control (tc) filters, and finally accessing sensitive setuid binaries or memory files (/proc/self/mem), indicating an attempt to escalate privileges to root.
Microsoft Sentinel (KQL)
