The rule detects a Linux kernel warning message logged to syslog containing the phrases "tc action pedit offset" and "out of bounds". This pattern indicates that the act_pedit path attempted to write beyond the allocated packet buffer, a condition associated with CVE-2026-46331. Exploitation typically involves crafted pedit netlink configurations in combination with page cache poisoning to achieve privilege escalation. A match on a host is a strong indicator that exploitation of the vulnerability, or triggering of the vulnerable code path, has occurred. The detection aggregates results by destination host and time window to aid triage and correlation with other indicators. It relies on kernel log ingestion (Linux syslog) and is intended to alert on potential privilege escalation attempts arising from this specific kernel flaw.