DirtyClone CVE-2026-43503 SUID /usr/bin/su page-cache in-memory patch

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•4

This rule detects activities associated with the DirtyClone (CVE-2026-43503) privilege escalation vulnerability on Linux systems. It monitors for the execution of exploit binaries from world-writable directories, the modification of critical process memory mapping files (/proc/self/uid_map, /proc/self/gid_map, /proc/self/setgroups) by non-root users, the use of unshare to create user namespaces as a precondition, and the anomalous spawning of shells by the SUID binary /usr/bin/su.