DirtyClone CVE-2026-43503 unprivileged user namespace creation for CAP_NET_ADMIN

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•2

Detects the use of 'unshare' or 'ip' commands by non-root users to manipulate Linux namespaces (e.g., user, network, or xfrm namespaces). These commands can be used to bypass security restrictions, facilitate container escapes, or perform local privilege escalation by exploiting vulnerabilities in the Linux kernel namespace subsystem.