TLDR Tech / InfoSec
DirtyClone: Fourth Linux Kernel Flaw in Six Weeks Escalates to Root
CVE-2026-43503 (CVSS 8.8), known as DirtyClone and detailed in a June 25 JFrog exploit walkthrough, is the fourth in the DirtyFrag family. It allows unprivileged local users to gain root by tricking the kernel into treating read-only, file-backed page-cache memory as writable. The attacker maps a privileged binary, such as/usr/bin/su, wires those pages into a packet, and forces decryption through an attacker-controlled IPsec tunnel, overwriting the binary's auth logic without touching the disk or leaving any logs. The exploit requires CAP_NET_ADMIN, available on Debian and Fedora through default unprivileged user namespaces, but Ubuntu 24.04+ blocks it via AppArmor. Root causes include fragment-transfer helpers dropping the shared-frag flag, as well as related vulnerabilities such as Copy Fail, DirtyFrag, and Fragnesia. Defenders should apply the May 21 mainline fix or, if immediate patching isn't possible, set kernel.unprivileged_userns_clone=0 or blacklist specific modules, knowing that this disables IPsec and AFS and that new DirtyFrag variants may still emerge.
Read the full story