DirtyClone CVE-2026-43503 LPE: XFRM Setup + Unprivileged su-to-Root Escalation

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•3

This rule detects potential exploitation of the DirtyClone vulnerability (CVE-2026-43503) by correlating prerequisites (XFRM state/policy creation, specific kernel module loading, or namespace manipulation) with a subsequent local privilege escalation where an unprivileged process spawns a root shell using 'su'.