CVE-2026-46331 PACKET_EDIT_MEME Exploit Execution or Compilation on Linux

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•5

Detects the execution of known exploit binaries or the compilation of source files associated with the Linux PACKET_EDIT_MEME exploit (CVE-2026-46331). The rule monitors for specific binary names associated with the exploit, execution of these binaries from common staging directories (/tmp, /dev/shm, /run), and the use of GCC or CC compilers to build the exploit source files.