DirtyClone Linux Kernel Flaw CVE-2026-43503 Allows Local Privilege Escalation to Root

A new Linux kernel privilege escalation vulnerability, tracked as CVE-2026-43503 and nicknamed DirtyClone, has been publicly disclosed with a working exploit. Discovered by JFrog Security Research, the flaw carries a CVSS score of 8.8 and allows a local user to gain root access by corrupting file-backed memory through a cloned network packet.

The vulnerability resides in the kernel’s zero-copy networking implementation. When the kernel copies a network packet internally, two helper functions fail to preserve a safety flag that marks the packet’s memory as shared with a file on disk. An attacker can load a privileged binary (e.g., /usr/bin/su) into memory, wire those pages into a network packet, and force the kernel to clone it. The cloned packet passes through an attacker-controlled IPsec tunnel, where decryption overwrites the binary’s login checks with attacker-chosen bytes. The file on disk remains unchanged, leaving no audit trail and evading file-integrity tools. A reboot restores the original binary, but by then the attacker already has root.

Exploitation requires CAP_NET_ADMIN capability, which can be obtained inside an unprivileged user namespace on distributions like Debian and Fedora where such namespaces are enabled by default. Ubuntu 24.04 and later restrict namespace creation via AppArmor, blocking the default exploit path. The attack affects multi-tenant servers, CI runners, container hosts, and Kubernetes clusters where untrusted users can create namespaces. JFrog confirmed the exploit on Debian, Ubuntu, and Fedora with default namespace configurations.

DirtyClone is the fourth in a series of similar privilege escalation vulnerabilities, following Copy Fail (CVE-2026-31431), DirtyFrag (CVE-2026-43284, CVE-2026-43500), and Fragnesia (CVE-2026-46300). Each fix closed one code path but left others open. The underlying issue is a contract problem: every code path that moves skb fragments must preserve the shared-frag bit. The fix for CVE-2026-43503 was merged into Linux v7.1-rc5 on May 21, 2026, and has been backported to stable and LTS branches. Administrators are urged to install kernel updates from their distribution. Temporary workarounds include restricting unprivileged user namespaces or blacklisting the esp4, esp6, and rxrpc kernel modules.