DirtyClone CVE-2026-43503 Unprivileged Namespace LPE in Container/CI-CD Runner

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•1

Detects execution patterns associated with the DirtyClone local privilege escalation exploit. The rule monitors for the execution of the exploit binary, compilation of related exploit source code, the creation of combined user and network namespaces via unshare, manipulation of IPsec xfrm states/policies by unprivileged users, and the spawning of a root shell via su. These activities are indicative of an attempt to elevate privileges from an unprivileged context to root.