DirtyClone Linux Kernel Local Privilege Escalation via __pskb_copy_fclone() (CVE-2026-43503)
DirtyClone Linux Kernel Local Privilege Escalation via (TL-2026-0962), also tracked as DirtyClone, is a high-severity software vulnerability scored CVSS 8.8, first published 2026-06-27. It has no confirmed attribution, affects Linux Kernel Linux Kernel, references 1 CVE (CVE-2026-43503), maps to 21 MITRE ATT&CK techniques (T1005, T1016, T1059), and is covered by 9 detection rules and 20 indicators of compromise.
Key facts for TL-2026-0962
- Threat ID
- TL-2026-0962
- Also known as
- DirtyClone, DirtyFrag-4
- Severity
- HIGH
- CVSS
- 8.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-06-27
- Last reviewed
- 2026-06-27
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- technology, cloud, government administration, finance, health, telecoms, defense, criticalinfrastructure
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 20
Malware and tooling in DirtyClone Linux Kernel Local Privilege Escalation via
Malware and tooling: DirtyClone, aexdyhaxor/CVE-2026-43503-DirtyClone, no_c2_infrastructure_identified
DirtyClone (CVE-2026-43503, CVSS 8.8 HIGH) is a Linux kernel local privilege escalation vulnerability in the __pskb_copy_fclone() socket-buffer cloning function, which silently drops the SKBFL_SHARED_FRAG safety flag, enabling an unprivileged user to overwrite page-cache-backed setuid binaries in memory via a seven-step IPsec/XFRM exploit chain — achieving root without leaving on-disk artifacts. Fixed in Linux v7.1-rc5 (May 24, 2026); PoC walkthrough published June 25, 2026 by JFrog Security Research.
How DirtyClone Linux Kernel Local Privilege Escalation via works
DirtyClone is the fourth confirmed member of the DirtyFrag family of Linux kernel socket-buffer (skb) metadata-propagation defects. The root cause is a class-wide contract violation: fragment-transfer helper functions that move pages between skb structures are required to preserve the SKBFL_SHARED_FRAG flag in skb_shinfo()->flags, but __pskb_copy_fclone() (and related helpers skb_shift(), skb_gro_receive(), skb_try_coalesce()) clear or fail to copy this flag. The flag marks pages that are backed by the kernel page cache — typically memory-mapped read-only executables such as /usr/bin/su or /usr/bin/sudo. When the flag is absent, skb_has_shared_frag() returns false, bypassing the mandatory skb_cow_data() copy-on-write path, and allowing the IPsec ESP input handler (esp_input()) to perform in-place AES-CBC decryption directly onto page-cache-backed memory.
The seven-step exploit chain requires only unprivileged user namespace access (a standard default on Debian, Fedora, and recent Ubuntu). Step 1: memory-map /usr/bin/su read-only, loading its pages into the page cache. Step 2: use vmsplice(2) and splice(2) to wire page-cache pages into a UDP socket send buffer. Step 3: use unshare(1) -Urn to enter a new network namespace, then configure a loopback IPsec tunnel (ESP, AES-CBC) with attacker-controlled keys. Step 4: install a netfilter TEE rule (nf_dup_ipv4 / xt_TEE) targeting the crafted UDP packets; the TEE module calls __pskb_copy_fclone(), generating a cloned skb without the SKBFL_SHARED_FRAG flag. Step 5: the cloned skb routes into esp_input(), which detects no shared-frag protection and performs in-place decryption onto the underlying page-cache page. Step 6: the attacker pre-computes ciphertext such that AES-CBC decryption produces target bytes that patch /usr/bin/su's authentication logic at a chosen offset. Step 7: execute su; the kernel serves the corrupted page from cache; authentication is bypassed and a root shell is returned.
The attack is fully in-memory and leaves no on-disk trace. File-integrity monitors (AIDE, Tripwire, dm-verity) miss it. Kernel audit logs show no anomalous file writes. A reboot restores the original binary. The vulnerability is present from kernel 3.9 (when SKBFL_SHARED_FRAG was introduced) through 7.0.9 and all 7.1-rc1 through rc4 pre-releases. The fix — eight commits propagating flag preservation across all affected helpers in net/core/skbuff.c, net/core/gro.c, and net/ipv4/tcp_output.c — was merged May 21, 2026 and first shipped in v7.1-rc5 on May 24, 2026.
The DirtyFrag family also includes CVE-2026-31431 (Copy Fail, April 2026), CVE-2026-43284 and CVE-2026-43500 (original DirtyFrag pair, May 4, 2026), CVE-2026-46300 (Fragnesia, May 13, 2026), and the related-but-distinct CVE-2026-46331 (pedit COW, June 16, 2026 — tc/act_pedit subsystem path, public exploit within 24 hours of disclosure). Systems that applied the original DirtyFrag patch batch but missed the DirtyClone fix remain fully vulnerable.
DirtyClone is particularly dangerous in cloud multi-tenant and container environments where unprivileged user namespaces are enabled by default. Container runtimes (Docker rootless, Podman, containerd) rely on user namespaces; disabling them as a workaround breaks those workloads. AppArmor restricts the default exploit path on Ubuntu 24.04+ but does not constitute a complete mitigation. No threat-actor attribution or in-the-wild exploitation has been confirmed as of June 27, 2026, but weaponization risk is elevated given the June 25, 2026 JFrog exploit walkthrough publication.
MITRE ATT&CK techniques used in TL-2026-0962
Collection
Discovery
T1016 System Network Configuration Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery
Execution
T1059 Command and Scripting Interpreter; T1106 Native API; T1203 Exploitation for Client Execution
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism
Defense Evasion
T1070 Indicator Removal; T1497 Virtualization/Sandbox Evasion; T1564 Hide Artifacts
Initial Access
Lateral Movement
T1210 Exploitation of Remote Services
Persistence
T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution
privilege-escalation
T1548 Abuse Elevation Control Mechanism
defense-impairment
T1553 Subvert Trust Controls; T1601 Modify System Image; T1685 Disable or Modify Tools
Resource Development
Affected products and versions in DirtyClone Linux Kernel Local Privilege Escalation via
- Linux Kernel — Linux Kernel
Vulnerable versions: 3.9 through 5.10.256; 5.11 through 5.15.207; 5.16 through 6.1.173; 6.2 through 6.6.140; 6.7 through 6.12.90; 6.13 through 6.18.32; 6.19 through 7.0.9; 7.1-rc1 through 7.1-rc4
Fixed in: 7.1-rc5 and later - Debian — Debian GNU/Linux
Vulnerable versions: all supported releases using unpatched kernel
Fixed in: pending vendor backport - Canonical — Ubuntu
Vulnerable versions: all releases using unpatched kernel
Fixed in: Ubuntu 24.04+ partially mitigated by AppArmor; full fix requires kernel update - Red Hat — Fedora / RHEL
Vulnerable versions: all Fedora releases using unpatched kernel
Fixed in: pending vendor backport - SUSE — SUSE Linux Enterprise
Vulnerable versions: advisory published; unpatched systems
Fixed in: pending vendor backport
Remediation for DirtyClone Linux Kernel Local Privilege Escalation via
Patches
- Linux mainline commit 48f6a5356a33 (May 21, 2026) — primary fix
- Linux mainline commit f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4 — original patch
- Stable branch commit 179f1852bdedc300e373e807cc102cd81feff196
- Stable branch commit 12401fcfb01f53ccc63ab0a3246570fe8f3105ee
- Stable branch commit fbeab9555564a1b98e8582cd106dfe46c4606991
- Stable branch commit 9e171fc1d7d7
- Linux v7.1-rc5 — first release tag containing the fix (May 24, 2026)
- Files patched: net/core/skbuff.c, net/core/gro.c, net/ipv4/tcp_output.c
Immediate actions
- Update Linux kernel to v7.1-rc5 or apply distribution vendor backport patches
- Apply sysctl -w kernel.unprivileged_userns_clone=0 on Debian/Ubuntu/Fedora (breaks rootless containers — evaluate impact)
- Blacklist esp4/esp6/rxrpc kernel modules: echo 'install esp4 /bin/true' | sudo tee /etc/modprobe.d/disable-esp.conf (breaks IPsec)
- Flush page cache temporarily: echo 3 > /proc/sys/vm/drop_caches (non-persistent; clears any in-memory patch)
- Enforce AppArmor/SELinux/seccomp profiles to restrict CAP_NET_ADMIN acquisition in containers
- Monitor for unprivileged user namespace creation combined with IPsec loopback tunnel setup
- Enable Kernel Lockdown mode (LOCK_DOWN_KERNEL) to restrict kernel module loading where feasible
Workarounds
- Disable unprivileged user namespaces: sysctl -w kernel.unprivileged_userns_clone=0 (Debian/Ubuntu/Fedora)
- Blacklist xt_TEE and nf_dup_ipv4 netfilter modules if TEE rules are not operationally required
- Block ESP protocol at perimeter/host firewall for loopback traffic (iptables -A INPUT -i lo -p esp -j DROP)
- Restrict vmsplice(2) and splice(2) via seccomp profile in container runtime configurations
- Note: all workarounds carry operational impact on container/VPN/IPsec workloads
Longer-term hardening
- Deploy EDR with eBPF-based kernel telemetry to detect skb flag manipulation and anomalous esp_input() calls on loopback
- Implement runtime integrity checking for page-cache-backed executables using memory forensics tooling (Volatility, LiME)
- Enforce mandatory access control (SELinux/AppArmor) profiles that prevent unprivileged IPsec tunnel creation
- Adopt distribution kernel releases with the DirtyFrag family patch set applied class-wide
- Instrument kernel builds with SKBFL_SHARED_FRAG propagation assertions in CI pipelines
- Consider Kernel Address Space Layout Randomization (KASLR) + Stack Canaries as defense-in-depth
- Establish detection-rule coverage for the full DirtyFrag family (CVE-2026-31431, 43284, 43500, 46300, 43503, 46331)
CVEs associated with DirtyClone Linux Kernel Local Privilege Escalation via
Weaknesses (CWE) in DirtyClone Linux Kernel Local Privilege Escalation via
CWE-416, CWE-367, CWE-119
Timeline of DirtyClone Linux Kernel Local Privilege Escalation via
- CVE-2026-31431 (Copy Fail) — first DirtyFrag family member — disclosed, establishing the class of SKBFL_SHARED_FRAG propagation defects in Linux kernel skb fragment-transfer helpers.
- Original DirtyFrag pair (CVE-2026-43284 and CVE-2026-43500) patches merged to Linux mainline; kernel developers believed the SKBFL_SHARED_FRAG propagation contract was now fully enforced class-wide.
- Fragnesia (CVE-2026-46300) — third DirtyFrag family member — disclosed, demonstrating that the patch fix was still incomplete; additional skb helpers remained vulnerable.
- DirtyFrag primary researcher Hyunwoo Kim independently reports the __pskb_copy_fclone() variant to kernel security maintainers.
- JFrog Security Research independently discovers the __pskb_copy_fclone() vulnerability, builds a working proof-of-concept, and reports to Linux kernel maintainers under coordinated disclosure.
- Linux kernel fix merged to mainline (commit 48f6a5356a33, original patch f4c50a4034e6); eight commits propagate SKBFL_SHARED_FRAG preservation across all affected helpers in net/core/skbuff.c, net/core/gro.c, net/ipv4/tcp_output.c.
- CVE-2026-43503 assigned and published by MITRE/NVD with CVSS 3.1 score of 8.8 HIGH and vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
- Linux v7.1-rc5 released — first kernel release tag containing the DirtyClone fix; distribution vendor backport process begins.
- CVE-2026-46331 (pedit COW) — a related but distinct sixth family member using the tc/act_pedit subsystem path — publicly disclosed; working exploit appears within 24 hours, raising awareness of the full DirtyFrag vulnerability class.
- JFrog Security Research publishes full DirtyClone analysis and working exploit walkthrough; GitHub PoC repository (aexdyhaxor/CVE-2026-43503-DirtyClone) appears. Exploit code itself withheld; walkthrough sufficient for experienced exploit developers to reproduce.
- Wide public media coverage across CybersecurityNews, The Hacker News, GBHackers, and security research blogs; vulnerability risk window elevated as unpatched systems remain broadly exposed.
- As of June 27, 2026, no confirmed in-the-wild exploitation or threat-actor attribution reported. CISA KEV catalog does not list CVE-2026-43503. Weaponization risk elevated given public PoC walkthrough.
Sources cited for DirtyClone Linux Kernel Local Privilege Escalation via
- Dissecting and Exploiting DirtyClone (CVE-2026-43503) — JFrog Security Research
- DirtyClone Linux Vulnerability (CVE-2026-43503) — CyberSecurity News
- New DirtyClone Linux Kernel Flaw Lets Local Users Gain Root via Cloned Packets — The Hacker News
- CVE-2026-43503: Linux Kernel Shared Fragment Handler Vulnerability — SecurityVulnerability.io
- CVE-2026-43503: DirtyClone Linux Privilege Escalation — Threat-Modeling.com
- Two new Linux LPEs hit page cache: pedit COW and DirtyClone — TheCyberSecGuru
- Propagation Defects in the Linux Kernel: CVE-2026-43503 — DenizHalil
- Linux Kernel DirtyClone Vulnerability Lets Local Attackers Gain Root Privileges — GBHackers
- CVE-2026-43503 PoC Repository — aexdyhaxor/CVE-2026-43503-DirtyClone (GitHub)
- NVD CVE Detail — CVE-2026-43503
- Linux Kernel Mainline Fix Commit 48f6a5356a33 — kernel.org
- Linux Kernel Mainline Fix Commit f4c50a4034e6 — kernel.org
- Original DirtyFrag CVE-2026-43284 Advisory
- CVE-2026-46331 (pedit COW) Disclosure — Related DirtyFrag Family
- CISA Known Exploited Vulnerabilities Catalog (CVE-2026-43503 not listed as of 2026-06-27)
Threats related to DirtyClone Linux Kernel Local Privilege Escalation via
- Linux Kernel act_pedit COW Out-of-Bounds Write Enables Local Privilege Escalation to Root (CVE-2026-46331)
- Linux Kernel 'Copy Fail' Local Privilege Escalation (CVE-2026-31431) — algif_aead 4-Byte Page Cache Write to setuid Root
- Linux Kernel act_pedit Partial Copy-on-Write Page-Cache Corruption Local Privilege Escalation (CVE-2026-46331, "pedit COW")
- DirtyClone (CVE-2026-43503): Linux Kernel Packet-Cloning Page-Cache Write Enables Local Privilege Escalation to Root via IPsec ESP
- PinTheft — Linux Kernel RDS Zerocopy FOLL_PIN Refcount Imbalance Chained With io_uring Fixed Buffers For Page-Cache Overwrite And Local Root (Public PoC, Arch Linux Default-Affected)
- Linux Kernel 'Dirty Frag' Universal Local Privilege Escalation — xfrm-ESP & RxRPC Page-Cache Write (No CVE, Public PoC)
Detection coverage for TL-2026-0962
As of 2026-06-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0962 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.