CVE-2026-43503 DirtyClone LPE: unshare + IPsec + /usr/bin/su page-cache patch

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•2

Detects execution artifacts and prerequisite activities associated with the DirtyClone (CVE-2026-43503) local privilege escalation exploit. This includes monitoring for the creation of unprivileged user namespaces, loading specific kernel modules (esp4, esp6, rxrpc) often used in such exploits, compilation of associated exploit source files, and direct interaction with /proc/self/mem to perform memory-based exploitation.