DirtyClone CVE-2026-43503 unprivileged user namespace creation for LPE

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

Detects the execution of 'unshare' by an unprivileged user to create a new user namespace, followed by a write operation to '/proc/self/uid_map', '/proc/self/gid_map', or '/proc/self/setgroups'. This sequence is a known technique for local privilege escalation (LPE) vulnerabilities, such as those related to unprivileged user namespaces.