DirtyClone CVE-2026-43503 LPE: Unprivileged User Namespace + IPsec Tunnel + su Exploit Chain

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•4

Detects evidence of the DirtyClone (CVE-2026-43503) Linux kernel privilege escalation exploit. The rule identifies a multi-stage attack chain, including the compilation of the exploit binary, creation of unprivileged user and network namespaces required for the exploit, and the use of the 'ip' utility to configure XFRM states/policies for page cache corruption.