CVE-2026-46331 pedit COW exploit chain in container or CI/CD runner

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

Detects execution of the CVE-2026-46331 exploit chain, which utilizes unprivileged user namespace creation to escalate privileges followed by malicious Linux traffic control (tc) pedit actions to achieve kernel-level page cache corruption.