CVE-2026-46331 User Namespace Creation for CAP_NET_ADMIN via unshare or ip netns

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•5

Detects the creation of user namespaces combined with network namespace flags using 'unshare' or 'ip netns' by non-root users. This activity is a necessary precursor for exploiting the CVE-2026-46331 vulnerability (pedit COW) to gain CAP_NET_ADMIN capabilities and subsequently corrupt the Linux page cache.