DirtyClone CVE-2026-43503 LPE: Full 5-Step Kill Chain (Critical)

Ibrahim Saud@tektrix

•updated Jun 26, 2026•1•0•6

Detects a suspected 5-step exploit sequence targeting CVE-2026-43503 on Linux systems. The rule monitors for unprivileged user and network namespace creation, followed by XFRM state modification, kernel module loading, raw ESP socket creation, and finally writing to /proc/[pid]/mem to facilitate page-cache corruption and bypass Copy-on-Write (CoW) protections.