This page may contain stale information. Last updated: 2026-06-28
Definition
DirtyClone (CVE-2026-43503) is a high-severity (CVSS 8.8) Linux kernel local privilege escalation variant in the dirtyfrag vulnerability family. Triggered when __pskb_copy_fclone() drops the SKBFL_SHARED_FRAG flag during netfilter TEE packet cloning in the XFRM/IPsec path.
Key Points
- Impact: Unprivileged local user → root via page-cache write to executables (e.g.,
/usr/bin/su) - Stealth: No kernel logs or audit traces; bypasses on-disk integrity monitoring
- Requirements: CAP_NET_ADMIN (often via unprivileged user namespaces)
- Fixed: Linux v7.1-rc5 (May 21, 2026); requires full DirtyFrag patch chain
- Discovered: jfrog Security Research (May 19, 2026)
Mitigations
- Update kernel to v7.1-rc5+ or distribution backport
kernel.unprivileged_userns_clone=0- Blacklist esp4, esp6, rxrpc modules
Related
- dirtyfrag
- jfrog
- supply-chain-security
- devsecops
- linux-kernel-security
- 2026-06-27-linux-kernel-dirtyclone-cve-2026-43503
- linux-kernel-dirtyclone-cve-2026-43503