# DirtyClone Linux Kernel Local Privilege Escalation via __pskb_copy_fclone() (CVE-2026-43503)

> DirtyClone (CVE-2026-43503, CVSS 8.8 HIGH) is a Linux kernel local privilege escalation vulnerability in the __pskb_copy_fclone() socket-buffer cloning function, which silently drops the SKBFL_SHARED_FRAG safety flag, enabling an unprivileged user to overwrite page-cache-backed setuid binaries in memory via a seven-step IPsec/XFRM exploit chain — achieving root without leaving on-disk artifacts. Fixed in Linux v7.1-rc5 (May 24, 2026); PoC walkthrough published June 25, 2026 by JFrog Security Research.

- **Published:** 2026-06-27T00:00:00Z
- **Last reviewed:** 2026-06-27T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0962
- **ID:** TL-2026-0962
- **Severity:** HIGH (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-43503

## Description

DirtyClone is the fourth confirmed member of the DirtyFrag family of Linux kernel socket-buffer (skb) metadata-propagation defects. The root cause is a class-wide contract violation: fragment-transfer helper functions that move pages between skb structures are required to preserve the SKBFL_SHARED_FRAG flag in skb_shinfo()->flags, but __pskb_copy_fclone() (and related helpers skb_shift(), skb_gro_receive(), skb_try_coalesce()) clear or fail to copy this flag. The flag marks pages that are backed by the kernel page cache — typically memory-mapped read-only executables such as /usr/bin/su or /usr/bin/sudo. When the flag is absent, skb_has_shared_frag() returns false, bypassing the mandatory skb_cow_data() copy-on-write path, and allowing the IPsec ESP input handler (esp_input()) to perform in-place AES-CBC decryption directly onto page-cache-backed memory.

The seven-step exploit chain requires only unprivileged user namespace access (a standard default on Debian, Fedora, and recent Ubuntu). Step 1: memory-map /usr/bin/su read-only, loading its pages into the page cache. Step 2: use vmsplice(2) and splice(2) to wire page-cache pages into a UDP socket send buffer. Step 3: use unshare(1) -Urn to enter a new network namespace, then configure a loopback IPsec tunnel (ESP, AES-CBC) with attacker-controlled keys. Step 4: install a netfilter TEE rule (nf_dup_ipv4 / xt_TEE) targeting the crafted UDP packets; the TEE module calls __pskb_copy_fclone(), generating a cloned skb without the SKBFL_SHARED_FRAG flag. Step 5: the cloned skb routes into esp_input(), which detects no shared-frag protection and performs in-place decryption onto the underlying page-cache page. Step 6: the attacker pre-computes ciphertext such that AES-CBC decryption produces target bytes that patch /usr/bin/su's authentication logic at a chosen offset. Step 7: execute su; the kernel serves the corrupted page from cache; authentication is bypassed and a root shell is returned.

The attack is fully in-memory and leaves no on-disk trace. File-integrity monitors (AIDE, Tripwire, dm-verity) miss it. Kernel audit logs show no anomalous file writes. A reboot restores the original binary. The vulnerability is present from kernel 3.9 (when SKBFL_SHARED_FRAG was introduced) through 7.0.9 and all 7.1-rc1 through rc4 pre-releases. The fix — eight commits propagating flag preservation across all affected helpers in net/core/skbuff.c, net/core/gro.c, and net/ipv4/tcp_output.c — was merged May 21, 2026 and first shipped in v7.1-rc5 on May 24, 2026.

The DirtyFrag family also includes CVE-2026-31431 (Copy Fail, April 2026), CVE-2026-43284 and CVE-2026-43500 (original DirtyFrag pair, May 4, 2026), CVE-2026-46300 (Fragnesia, May 13, 2026), and the related-but-distinct CVE-2026-46331 (pedit COW, June 16, 2026 — tc/act_pedit subsystem path, public exploit within 24 hours of disclosure). Systems that applied the original DirtyFrag patch batch but missed the DirtyClone fix remain fully vulnerable.

DirtyClone is particularly dangerous in cloud multi-tenant and container environments where unprivileged user namespaces are enabled by default. Container runtimes (Docker rootless, Podman, containerd) rely on user namespaces; disabling them as a workaround breaks those workloads. AppArmor restricts the default exploit path on Ubuntu 24.04+ but does not constitute a complete mitigation. No threat-actor attribution or in-the-wild exploitation has been confirmed as of June 27, 2026, but weaponization risk is elevated given the June 25, 2026 JFrog exploit walkthrough publication.

## MITRE ATT&CK

- T1068 Exploitation for Privilege Escalation
- T1548 Abuse Elevation Control Mechanism
- T1548 Abuse Elevation Control Mechanism
- T1601 Modify System Image
- T1553 Subvert Trust Controls
- T1070 Indicator Removal
- T1685 Disable or Modify Tools
- T1564 Hide Artifacts
- T1497 Virtualization/Sandbox Evasion
- T1059 Command and Scripting Interpreter
- T1203 Exploitation for Client Execution
- T1106 Native API
- T1547 Boot or Logon Autostart Execution
- T1543 Create or Modify System Process
- T1082 System Information Discovery
- T1016 System Network Configuration Discovery
- T1083 File and Directory Discovery
- T1078 Valid Accounts
- T1210 Exploitation of Remote Services
- T1005 Data from Local System
- T1587 Develop Capabilities
- T1588 Obtain Capabilities

## Sources

- [Dissecting and Exploiting DirtyClone (CVE-2026-43503) — JFrog Security Research](https://research.jfrog.com/post/dissecting-and-exploiting-linux-lpe-variant-dirtyclone-cve-2026-43503/)
- [DirtyClone Linux Vulnerability (CVE-2026-43503) — CyberSecurity News](https://cybersecuritynews.com/dirtyclone-linux-vulnerability/)
- [New DirtyClone Linux Kernel Flaw Lets Local Users Gain Root via Cloned Packets — The Hacker News](https://thehackernews.com/2026/06/new-dirtyclone-linux-kernel-flaw-lets.html)
- [CVE-2026-43503: Linux Kernel Shared Fragment Handler Vulnerability — SecurityVulnerability.io](https://securityvulnerability.io/vulnerability/CVE-2026-43503)
- [CVE-2026-43503: DirtyClone Linux Privilege Escalation — Threat-Modeling.com](https://threat-modeling.com/cve-2026-43503-dirtyclone-linux-privilege-escalation/)
- [Two new Linux LPEs hit page cache: pedit COW and DirtyClone — TheCyberSecGuru](https://thecybersecguru.com/news/linux-lpe-pedit-cow-dirtyclone-cve-2026-46331-cve-2026-43503/)
- [Propagation Defects in the Linux Kernel: CVE-2026-43503 — DenizHalil](https://denizhalil.com/2026/06/26/cve-2026-43503-dirtyclone-linux-kernel-lpe/)
- [Linux Kernel DirtyClone Vulnerability Lets Local Attackers Gain Root Privileges — GBHackers](https://gbhackers.com/linux-kernel-dirtyclone-vulnerability/)
- [CVE-2026-43503 PoC Repository — aexdyhaxor/CVE-2026-43503-DirtyClone (GitHub)](https://github.com/aexdyhaxor/CVE-2026-43503-DirtyClone)
- [NVD CVE Detail — CVE-2026-43503](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-43503)
- [Linux Kernel Mainline Fix Commit 48f6a5356a33 — kernel.org](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=48f6a5356a33)
- [Linux Kernel Mainline Fix Commit f4c50a4034e6 — kernel.org](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4)
- [Original DirtyFrag CVE-2026-43284 Advisory](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43284)
- [CVE-2026-46331 (pedit COW) Disclosure — Related DirtyFrag Family](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46331)
- [CISA Known Exploited Vulnerabilities Catalog (CVE-2026-43503 not listed as of 2026-06-27)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0962