DirtyClone Linux Kernel Local Privilege Escalation

DirtyClone, identified as CVE-2026-43503, is a high-severity (CVSS 8.8) local privilege escalation vulnerability affecting the Linux kernel's networking subsystem. It is part of the 'DirtyFrag' family of flaws, characterized by the kernel's failure to maintain proper metadata (the SKBFL_SHARED_FRAG flag) when cloning network packet fragments. This failure causes the kernel to treat read-only, file-backed memory as private writable data, effectively bypassing Copy-on-Write (CoW) protections.

Technically, an attacker can load a privileged binary into memory and use a local IPsec tunnel to overwrite in-memory login checks without modifying the original binary on disk. This makes the attack highly stealthy, as file-integrity tools and reboots will not show signs of permanent disk tampering. The exploit has been confirmed to work on major distributions including Debian, Ubuntu, and Fedora that allow unprivileged user namespaces.

This vulnerability is particularly critical for multi-tenant environments, container hosts, and CI/CD runners where untrusted users might be granted the ability to create namespaces. Organizations should prioritize patching kernels to the fixed versions (e.g., v7.1-rc5 or backported LTS versions) immediately to prevent unauthorized root access.