# DirtyClone (CVE-2026-43503): Linux Kernel Packet-Cloning Page-Cache Write Enables Local Privilege Escalation to Root via IPsec ESP

> DirtyClone (CVE-2026-43503) is a Linux kernel local privilege escalation in the packet-cloning helpers __pskb_copy_fclone() and skb_shift(), which drop the SKBFL_SHARED_FRAG safety flag that marks an skb fragment as backed by a file-on-disk page. A local user holding CAP_NET_ADMIN (obtainable via unprivileged user namespaces on default Debian/Ubuntu/Fedora) can pin a read-only page-cache page (e.g. /usr/bin/su) into a cloned packet and route it through an attacker-controlled IPsec ESP tunnel, whose in-place AEAD decryption overwrites the cached binary's authentication checks in memory to gain root. The file on disk never changes, defeating file-integrity monitoring.

- **Published:** 2026-06-26T00:00:00Z
- **Last reviewed:** 2026-06-26T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0947
- **ID:** TL-2026-0947
- **Severity:** HIGH (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-43503

## Description

DirtyClone (CVE-2026-43503), CVSS 8.8, is the latest member of the DirtyFrag class of Linux kernel local privilege escalation vulnerabilities and was publicly demonstrated with a working exploit by JFrog Security Research on June 25, 2026. It is a clone-path variant of the page-cache-write technique first weaponized by Copy Fail (CVE-2026-31431) and DirtyFrag (CVE-2026-43284 / CVE-2026-43500).

Root cause: Linux's zero-copy networking allows a socket buffer (skb) fragment to reference a page-cache page directly (planted via splice()/vmsplice()). To stay safe, the kernel marks such fragments with the SKBFL_SHARED_FRAG flag so that any code about to mutate the buffer first performs a copy-on-write via skb_cow_data(). The two packet-cloning helpers __pskb_copy_fclone() and skb_shift() fail to propagate this flag to the cloned/shifted skb. As a result a clone of a file-backed skb is treated as private writable memory. When that clone traverses the IPsec ESP receive path (esp_input -> crypto_authenc_esn_decrypt), the AEAD layer decrypts in place directly on top of the pinned page-cache page, producing an attacker-controlled write into the page cache of any file the attacker can read.

Exploit chain: (1) the attacker creates an unprivileged user namespace to obtain CAP_NET_ADMIN within it; (2) opens an AF_KEY/XFRM socket and configures an ESP security association under attacker control; (3) uses splice()/vmsplice() to plant a reference to the read-only page-cache page of a privileged binary such as /usr/bin/su into an skb fragment; (4) forces the kernel to clone or shift that skb through the flawed helper, dropping SKBFL_SHARED_FRAG; (5) routes the cloned packet through the attacker's IPsec ESP tunnel where in-place decryption overwrites the binary's login/credential checks in the kernel's in-memory copy; (6) on next execution of su the modified in-memory page grants a root shell. Because the on-disk file is never modified, file-integrity tools (AIDE, Tripwire, IMA) do not detect the change.

The flawed flag-propagation behavior in the clone path is shared with the wider DirtyFrag family whose original page-cache-write primitive was introduced with commit cac2661c53f3 (January 2017); Linux distributions released in roughly the last nine years are likely affected. The fix for DirtyClone was merged upstream on May 21, 2026 (commit 48f6a5356a33), the CVE was assigned May 23, 2026, and the change shipped in Linux v7.1-rc5 (May 24, 2026) and was backported to stable and LTS branches and distribution kernels. Unpatched systems with unprivileged user namespaces enabled remain exploitable. Default Debian and Fedora enable unprivileged user namespaces; Ubuntu 24.04+ partially mitigates by restricting namespace creation via an AppArmor profile.

## MITRE ATT&CK

- T1068 Exploitation for Privilege Escalation
- T1548 Abuse Elevation Control Mechanism
- T1611 Escape to Host
- T1556 Modify Authentication Process
- T1070 Indicator Removal
- T1211 Exploitation for Stealth
- T1553 Subvert Trust Controls
- T1554 Compromise Host Software Binary
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1078 Valid Accounts
- T1082 System Information Discovery
- T1212 Exploitation for Credential Access
- T1574 Hijack Execution Flow
- T1083 File and Directory Discovery
- T1518 Software Discovery
- T1556 Modify Authentication Process
- T1548 Abuse Elevation Control Mechanism

## Sources

- [New DirtyClone Linux Kernel Flaw Lets Local Users Gain Root](https://thehackernews.com/2026/06/new-dirtyclone-linux-kernel-flaw-lets.html)
- [JFrog Security Research](https://research.jfrog.com/)
- [Dirty Frag (CVE-2026-43284, CVE-2026-43500): Linux Kernel Privilege Escalation FAQ](https://www.tenable.com/blog/dirty-frag-cve-2026-43284-cve-2026-43500-frequently-asked-questions-linux-kernel-lpe)
- [Dirty Frag Linux kernel local privilege escalation vulnerability mitigations](https://ubuntu.com/blog/dirty-frag-linux-vulnerability-fixes-available)
- [Dirty Frag (CVE-2026-43284 / CVE-2026-43500): Detecting unpatched LPE via Linux Kernel ESP and RxRPC](https://www.sysdig.com/blog/dirty-frag-cve-2026-43284-and-cve-2026-43500-detecting-unpatched-local-privilege-escalation-via-linux-kernel-esp-and-rxrpc)
- [Dirty Frag LPE: CVE-2026-43284 and CVE-2026-43500 Deep Dive](https://www.picussecurity.com/resource/blog/dirty-frag-lpe-cve-2026-43284-and-cve-2026-43500-deep-dive)
- [Copy Fail: Universal Linux Local Privilege Escalation Vulnerability (CVE-2026-31431)](https://www.wiz.io/blog/copyfail-cve-2026-31431-linux-privilege-escalation-vulnerability)
- [CVE-2026-31431: Copy Fail vulnerability enables Linux root privilege escalation across cloud environments](https://www.microsoft.com/en-us/security/blog/2026/05/01/cve-2026-31431-copy-fail-vulnerability-enables-linux-root-privilege-escalation/)
- [RHSB-2026-002 Cryptographic Subsystem Privilege Escalation - Linux Kernel (CVE-2026-31431) - Copy Fail](https://access.redhat.com/security/vulnerabilities/RHSB-2026-002)
- [CERT-EU - High Vulnerability in the Linux Kernel (Copy Fail)](https://cert.europa.eu/publications/security-advisories/2026-005/)
- [How Cloudflare responded to the Copy Fail Linux vulnerability](https://blog.cloudflare.com/copy-fail-linux-vulnerability-mitigation/)
- [Dirty Frag: A Universal Linux LPE via ESP and RxRPC](https://www.upwind.io/feed/dirty-frag-linux-root-exploit-esp-rxrpc)
- [NVD - CVE-2026-43503](https://nvd.nist.gov/vuln/detail/CVE-2026-43503)
- [Ubuntu Security Notice USN-8373-1: Linux kernel vulnerabilities](https://ubuntu.com/security/notices/USN-8373-1)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0947