pedit COW SUID Privilege Escalation: /bin/su Spawned by Non-Root Process

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

Detects instances where the /bin/su binary is executed by a non-root process but succeeds in launching as the root user. This behavior is indicative of potential memory-based privilege escalation exploits, such as page cache poisoning (e.g., pedit COW variants), which allow unauthorized SUID binary execution without modifying the binary on disk.