CVE-2026-46331 pedit COW: SUID /bin/su Page Cache Poison to Root Shell

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•0

Detects execution of known Proof-of-Concept binaries (pedit_cow_demo or packet_edit_meme) followed by /bin/su spawning /bin/sh, which indicates successful exploitation of the pedit COW vulnerability resulting in shellcode execution with root privileges.