CVE-2026-46331 act_pedit Netlink TC Rule Configuration by Non-Root Process
Detects the execution of the Linux 'tc' (traffic control) utility with 'act_pedit' by an unprivileged (non-root) user. This pattern is associated with attempts to leverage the CVE-2026-46331 vulnerability, which involves a Copy-on-Write (COW) kernel exploit triggered through malicious netlink operations in the traffic control subsystem to achieve privilege escalation.
YARA-L
