CVE-2026-46331 act_pedit Netlink TC Rule Configuration by Non-Root Process

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

This rule detects unprivileged processes executing Linux traffic control (tc) commands that leverage the 'act_pedit' action. Such behavior is highly unusual for non-root users and matches the exploitation pattern of the CVE-2026-46331 pedit copy-on-write (COW) kernel vulnerability, which attempts to escalate privileges via netlink socket operations.