CVE-2026-46331 pedit COW: Root Shell Spawned from Setuid Binary by Unprivileged User

Ibrahim Saud@tektrix

•updated Jun 27, 2026•1•0•6

Detects unauthorized shells (bash, sh, dash, zsh) spawned as root from common setuid binaries (su, sudo, newgrp) by an unprivileged user. This behavior is indicative of the CVE-2026-46331 'pedit COW' vulnerability, where a local attacker performs page cache poisoning on a setuid binary to execute arbitrary code as root without disk modification.