CVE-2026-46331 AppArmor Bypass via aa-exec to Enable Unprivileged User Namespace

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

Detects attempts to bypass AppArmor security profiles using aa-exec to execute processes under restricted contexts (trinity, chrome, flatpak), which is a component of the CVE-2026-46331 (pedit COW) exploit chain. Additionally, it monitors for unauthorized removal or disabling of AppArmor policies via aa-disable, aa-teardown, or apparmor_parser -R, which are often indicative of an adversary attempting to weaken system security to facilitate privilege escalation.