DirtyClone (CVE-2026-43503): Linux Kernel Packet-Cloning Page-Cache Write Enables Local Privilege Escalation to Root via IPsec ESP

DirtyClone (CVE-2026-43503) (TL-2026-0947), also tracked as DirtyClone, is a high-severity software vulnerability scored CVSS 8.8, first published 2026-06-26. It has no confirmed attribution, affects Linux Linux Kernel, references 1 CVE (CVE-2026-43503), maps to 16 MITRE ATT&CK techniques (T1059, T1068, T1070), and is covered by 9 detection rules and 21 indicators of compromise.

Key facts for TL-2026-0947

Threat ID
TL-2026-0947
Also known as
DirtyClone
Severity
HIGH
CVSS
8.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-06-26
Last reviewed
2026-06-26
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
technology, cloud, hosting, financial, government, telecommunications, education
Target regions
Global
Detection rules
9
Indicators of compromise
21

DirtyClone (CVE-2026-43503) is a Linux kernel local privilege escalation in the packet-cloning helpers __pskb_copy_fclone() and skb_shift(), which drop the SKBFL_SHARED_FRAG safety flag that marks an skb fragment as backed by a file-on-disk page. A local user holding CAP_NET_ADMIN (obtainable via unprivileged user namespaces on default Debian/Ubuntu/Fedora) can pin a read-only page-cache page (e.g. /usr/bin/su) into a cloned packet and route it through an attacker-controlled IPsec ESP tunnel, whose in-place AEAD decryption overwrites the cached binary's authentication checks in memory to gain root. The file on disk never changes, defeating file-integrity monitoring.

How DirtyClone (CVE-2026-43503) works

DirtyClone (CVE-2026-43503), CVSS 8.8, is the latest member of the DirtyFrag class of Linux kernel local privilege escalation vulnerabilities and was publicly demonstrated with a working exploit by JFrog Security Research on June 25, 2026. It is a clone-path variant of the page-cache-write technique first weaponized by Copy Fail (CVE-2026-31431) and DirtyFrag (CVE-2026-43284 / CVE-2026-43500).

Root cause: Linux's zero-copy networking allows a socket buffer (skb) fragment to reference a page-cache page directly (planted via splice()/vmsplice()). To stay safe, the kernel marks such fragments with the SKBFL_SHARED_FRAG flag so that any code about to mutate the buffer first performs a copy-on-write via skb_cow_data(). The two packet-cloning helpers __pskb_copy_fclone() and skb_shift() fail to propagate this flag to the cloned/shifted skb. As a result a clone of a file-backed skb is treated as private writable memory. When that clone traverses the IPsec ESP receive path (esp_input -> crypto_authenc_esn_decrypt), the AEAD layer decrypts in place directly on top of the pinned page-cache page, producing an attacker-controlled write into the page cache of any file the attacker can read.

Exploit chain: (1) the attacker creates an unprivileged user namespace to obtain CAP_NET_ADMIN within it; (2) opens an AF_KEY/XFRM socket and configures an ESP security association under attacker control; (3) uses splice()/vmsplice() to plant a reference to the read-only page-cache page of a privileged binary such as /usr/bin/su into an skb fragment; (4) forces the kernel to clone or shift that skb through the flawed helper, dropping SKBFL_SHARED_FRAG; (5) routes the cloned packet through the attacker's IPsec ESP tunnel where in-place decryption overwrites the binary's login/credential checks in the kernel's in-memory copy; (6) on next execution of su the modified in-memory page grants a root shell. Because the on-disk file is never modified, file-integrity tools (AIDE, Tripwire, IMA) do not detect the change.

The flawed flag-propagation behavior in the clone path is shared with the wider DirtyFrag family whose original page-cache-write primitive was introduced with commit cac2661c53f3 (January 2017); Linux distributions released in roughly the last nine years are likely affected. The fix for DirtyClone was merged upstream on May 21, 2026 (commit 48f6a5356a33), the CVE was assigned May 23, 2026, and the change shipped in Linux v7.1-rc5 (May 24, 2026) and was backported to stable and LTS branches and distribution kernels. Unpatched systems with unprivileged user namespaces enabled remain exploitable. Default Debian and Fedora enable unprivileged user namespaces; Ubuntu 24.04+ partially mitigates by restricting namespace creation via an AppArmor profile.

MITRE ATT&CK techniques used in TL-2026-0947

Execution

T1059 Command and Scripting Interpreter; T1106 Native API

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism; T1611 Escape to Host

Defense Evasion

T1070 Indicator Removal; T1078 Valid Accounts; T1211 Exploitation for Stealth

Discovery

T1082 System Information Discovery; T1083 File and Directory Discovery; T1518 Software Discovery

Credential Access

T1212 Exploitation for Credential Access; T1556 Modify Authentication Process

privilege-escalation

T1548 Abuse Elevation Control Mechanism

defense-impairment

T1553 Subvert Trust Controls; T1556 Modify Authentication Process

Persistence

T1554 Compromise Host Software Binary

stealth

T1574 Hijack Execution Flow

Affected products and versions in DirtyClone (CVE-2026-43503)

  • Linux — Linux Kernel
    Vulnerable versions: kernels prior to v7.1-rc5 with the SKBFL_SHARED_FRAG page-cache-write lineage (introduced ~2017, commit cac2661c53f3)
    Fixed in: v7.1-rc5 (commit 48f6a5356a33); stable/LTS backports
  • Canonical — Ubuntu
    Vulnerable versions: 22.04 LTS; 24.04 LTS (partial AppArmor mitigation); 25.10
    Fixed in: kernels per USN-8373-1
  • Debian — Debian GNU/Linux
    Vulnerable versions: stable releases with unprivileged user namespaces enabled by default
    Fixed in: distribution kernel security update with commit 48f6a5356a33
  • Red Hat / Fedora — Fedora
    Vulnerable versions: releases with unprivileged user namespaces enabled by default
    Fixed in: backported distribution kernel update

Remediation for DirtyClone (CVE-2026-43503)

Patches

  • Linux kernel v7.1-rc5 (commit 48f6a5356a33), backported to stable and LTS.
  • Ubuntu USN-8373-1 kernel updates.
  • Debian and SUSE distribution kernel security updates.

Immediate actions

  • Apply the distribution kernel update that includes upstream commit 48f6a5356a33 (Ubuntu USN-8373-1, plus Debian and SUSE advisories) and reboot.
  • Where patching is delayed, disable unprivileged user namespaces: set sysctl kernel.unprivileged_userns_clone=0 (Debian/Ubuntu) and/or user.max_user_namespaces=0.
  • Drop page caches after applying module/sysctl mitigations to evict any already-poisoned cached pages: echo 3 > /proc/sys/vm/drop_caches.

Workarounds

  • Blacklist the vulnerable ESP/IPsec modules: 'install esp4 /bin/false', 'install esp6 /bin/false' (and ipcomp4/ipcomp6) in /etc/modprobe.d/ — note this breaks IPsec functionality.
  • Set kernel.unprivileged_userns_clone=0 to remove the CAP_NET_ADMIN acquisition path for local users.

Longer-term hardening

  • Deploy runtime/behavioral EDR (e.g. Falco/Sysdig) rules that flag AF_KEY/XFRM setup or AF_RXRPC sockets from unprivileged-namespace contexts followed by splice() onto setuid binaries.
  • Adopt kernel live-patching and tighten patch SLAs for LTS kernels given the DirtyFrag family's recurrence.
  • Restrict unprivileged user-namespace creation fleet-wide via AppArmor (Ubuntu 24.04+ profile) or seccomp/LSM policy.

CVEs associated with DirtyClone (CVE-2026-43503)

CVE-2026-43503

Weaknesses (CWE) in DirtyClone (CVE-2026-43503)

CWE-787, CWE-281

Timeline of DirtyClone (CVE-2026-43503)

  • Page-cache-write lineage of the DirtyFrag family introduced upstream (commit cac2661c53f3) when zero-copy/in-place crypto paths were added; clone helpers do not propagate the file-backed-fragment safety flag.
  • Copy Fail (CVE-2026-31431), the first DirtyFrag-class Linux kernel page-cache-write LPE, publicly disclosed.
  • DirtyFrag (CVE-2026-43284 xfrm-ESP and CVE-2026-43500 RxRPC) page-cache-write LPEs disclosed; PoC released and ESP patch merged to netdev.
  • Fragnesia (CVE-2026-46300), a further DirtyFrag-family variant, disclosed.
  • Researcher Hyunwoo Kim submits a broader multi-site patch addressing additional flag-propagation gaps in packet-cloning helpers.
  • Fix for the DirtyClone clone-path variant merged upstream (commit 48f6a5356a33), restoring SKBFL_SHARED_FRAG propagation in __pskb_copy_fclone()/skb_shift().
  • CVE-2026-43503 assigned to the DirtyClone variant.
  • Fix ships in Linux kernel v7.1-rc5; backports to stable and LTS branches begin, along with distribution advisories (Ubuntu USN-8373-1, Debian, SUSE).
  • JFrog Security Research publicly demonstrates a working DirtyClone exploit achieving local root via IPsec ESP in-place decryption over a cloned, file-backed skb.
  • Threadlinqs Intelligence tracks DirtyClone as ACTIVE; unpatched systems with unprivileged user namespaces enabled remain exploitable.

Sources cited for DirtyClone (CVE-2026-43503)

Threats related to DirtyClone (CVE-2026-43503)

Detection coverage for TL-2026-0947

As of 2026-06-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0947 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats