this is generated only when the kernel's act_pedit module encounters a write outside the writable skb region. this never occurs in normal tc pedit usage.

splunk

Techniques

Sample rules

Linux Pedit Offset Out Of Bounds

source: splunk
technicques:

Description

The following detects a Linux kernel warning message containing “tc action pedit offset” and “out of bounds” logged to syslog, which indicates the act_pedit attempted to write past the bounds of an allocated packet buffer. This condition is associated with CVE-2026-46331, a kernel vulnerability that can be exploited via crafted pedit netlink configurations combined with page cache poisoning to achieve privilege escalation. The presence of this message on a host is a strong indicator that exploitation of this vulnerability, or triggering of the underlying vulnerable code path, has occurred.

Detection logic

`linux_syslog` "*tc action pedit offset*" "*out of bounds*" 
| rename host as dest 
| stats count min(_time) as firstTime max(_time) as lastTime by dest _raw 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `linux_pedit_offset_out_of_bounds_filter`