DirtyClone CVE-2026-43503: Unprivileged IPsec Tunnel Creation for In-Memory LPE

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•2

Detects execution patterns associated with the DirtyClone (CVE-2026-43503) exploit, which involves an unprivileged process utilizing user and network namespaces to configure IPsec XFRM Security Associations (SAs) to corrupt the kernel page cache of sensitive binaries such as /usr/bin/su.