CVE-2026-46331 act_pedit Traffic Control Action Pedit Abuse by Non-Root User

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

Detects execution of the tc (traffic control) utility with pedit actions by non-root users. This pattern is indicative of exploitation attempts targeting the Linux kernel act_pedit subsystem (CVE-2026-46331), which can lead to page cache corruption and local privilege escalation.