DirtyClone CVE-2026-43503 In-Memory Binary Modification via IPsec Tunnel

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•3

Detects in-memory privilege escalation patterns associated with the 'DirtyClone' (CVE-2026-43503) vulnerability. The rule monitors for a sequence of events where an unprivileged process utilizes 'unshare' to create user and network namespaces in conjunction with IPsec XFRM tunnel configurations, immediately followed by the execution of 'su' or 'sudo', resulting in unauthorized root access without disk-based modification of binary files.