CVE-2026-46331 pedit COW: User Namespace CAP_NET_ADMIN Abuse for LPE

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

Detects the use of the 'unshare' utility to create new namespaces on Linux systems. Adversaries often use 'unshare' to perform container escapes, escalate privileges, or isolate processes from host-level monitoring. This rule specifically filters out legitimate administrative or container management processes such as systemd, containerd, and runc to reduce noise.