g0thamrabb1t/cve-2026-46331-pedit-cow-detectionDefensive validation of CVE-2026-46331 / pedit COW with auditd, AppArmor, mitigation comparison and detection logic.
Defensive validation report for CVE-2026-46331, focused on Linux kernel
act_pedit, local privilege escalation behavior, auditd telemetry, AppArmor mitigation, and detection logic.
This repository contains defensive validation reports for CVE-2026-46331 / pedit COW, a Linux kernel local privilege escalation vulnerability related to net/sched/act_pedit.
The work documents a controlled lab validation on Ubuntu, including:
kernel.apparmor_restrict_unprivileged_unconfined=1.This repository does not provide exploit code. Its purpose is defensive analysis, detection engineering, vulnerability validation, and reporting.
The reports are available in the directory:
| Language | File |
|---|---|
| English | CVE-2026-46331_pedit_COW_auditd_EN.pdf |
| Polish | CVE-2026-46331_pedit_COW_auditd_PL.pdf |
The report documents whether the tested Ubuntu host met the conditions required for the local privilege escalation path, including:
act_pedit kernel module,aa-exec, and root process execution.The lab also compares system behavior before and after enabling:
kernel.apparmor_restrict_unprivileged_unconfined=1
The main value of this repository is detection-oriented validation. The report focuses on correlation of multiple telemetry sources rather than a single indicator.
High-confidence behavioral sequence:
unprivileged user
-> namespace creation
-> netlink socket usage
-> aa-exec / AppArmor profile transition
-> root_exec with euid=0
Useful auditd keys and indicators:
ns_create
netlink_socket
apparmor_bypass_path
root_exec
tc action pedit offset out of bounds
AppArmor DENIED sys_admin/net_admin
The reports also include example detection logic for auditd, Splunk SPL, XQL, kernel journal, and AppArmor events.
Current structure:
.
├── README.md
└── reports/
├── CVE-2026-46331_pedit_COW_auditd_EN.pdf
└── CVE-2026-46331_pedit_COW_auditd_PL.pdf
This is sufficient for the current scope. If detection rules are extracted into standalone files later, an optional /detections directory may be added:
detections/
├── auditd.rules
├── splunk.spl
└── xql.xql
This material may be useful for:
The material is intended for controlled validation, defensive detection development, and mitigation assessment. It must not be used to target systems without explicit authorization.
The tested mitigation reduced the practical impact of the tested exploitation path, but configuration mitigations should not be treated as a replacement for a kernel update. The recommended approach is to patch the kernel and maintain additional hardening where operationally possible.