Detection: Linux Pedit Offset Out Of Bounds

Updated Date: 2026-07-06 ID: 749d9bbf-cfa5-42d0-90e0-eb9300f7750a Author: Raven Tait, Splunk Type: TTP Product: Splunk Enterprise Security

Description

The following detects a Linux kernel warning message containing "tc action pedit offset" and "out of bounds" logged to syslog, which indicates the act_pedit attempted to write past the bounds of an allocated packet buffer. This condition is associated with CVE-2026-46331, a kernel vulnerability that can be exploited via crafted pedit netlink configurations combined with page cache poisoning to achieve privilege escalation. The presence of this message on a host is a strong indicator that exploitation of this vulnerability, or triggering of the underlying vulnerable code path, has occurred.

Search

1`linux_syslog` "*tc action pedit offset*" "*out of bounds*" 
2| rename host as dest 
3| stats count min(_time) as firstTime max(_time) as lastTime by dest _raw 
4| `security_content_ctime(firstTime)` 
5| `security_content_ctime(lastTime)` 
6| `linux_pedit_offset_out_of_bounds_filter`

Data Source

Name	Platform	Sourcetype	Source
Linux Messages Syslog	Linux	`'linux_messages_syslog'`	`'/var/log/kern'`

Macros Used

Name	Value
linux_syslog	`sourcetype="linux_messages_syslog"`
linux_pedit_offset_out_of_bounds_filter	`search *`

linux_pedit_offset_out_of_bounds_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1068	Exploitation for Privilege Escalation	Privilege Escalation

Exploitation

DE.CM

CIS 10

CVE

CVE-2026-46331

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Finding (Notable)	Yes
Rule Title	`%name%`
Rule Description	`%description%`
Notable Event Fields	user, dest
Creates Intermediate Finding (Risk Event)	No

TTP detections generate a Finding (Notable) and may generate Intermediate Findings (Risk Events) for associated entities.

Implementation

To successfully implement this search, you need to have relevant kernel logs ingested with the Splunk Add-On for Unix and Linux (https://splunkbase.splunk.com/app/833).

Known False Positives

This is generated only when the kernel's act_pedit module encounters a write outside the writable SKB region. This never occurs in normal tc pedit usage.

Associated Analytic Story

Linux Privilege Escalation

Finding

Title	Entity Field	Entity Type	Risk Score
Out-of-bounds write by act_pedit on $dest$ indicating possible privilege escalation.	dest	system	50

References

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`/var/log/kern`	`linux_messages_syslog`
Integration	✅ Passing	Dataset	`/var/log/kern`	`linux_messages_syslog`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 1