DirtyClone CVE-2026-43503 Unprivileged User+Net Namespace Creation for CAP_NET_ADMIN

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•1

Detects the exploit chain for CVE-2026-43503, an unprivileged kernel exploitation vulnerability. The rule identifies the creation of user and network namespaces by non-root users, followed by the manipulation of XFRM states or policies, and the subsequent loading of ESP kernel modules, which together facilitate privilege escalation.