New DirtyClone Linux Vulnerability Allows Attackers to Gain Root Access Via Cloned Packets

HomeCyber Security New DirtyClone Linux Vulnerability Allows Attackers to Gain Root Access Via Cloned Packets By Guru Baran June 26, 2026 A new Linux kernel local privilege escalation vulnerability, dubbed “DirtyClone” (CVE-2026-43503), that allows unprivileged local users to gain full root access by manipulating cloned network packets through the XFRM/IPsec subsystem, all without leaving a trace in kernel logs or audit records. DirtyClone is a high-severity variant in the DirtyFrag vulnerability family, a class of Linux kernel memory corruption bugs affecting how socket buffers (skb) reference shared page-cache memory. Tracked as CVE-2026-43503, uncovered by JFrog Security Research with a CVSS score of 8.8, it was discovered by JFrog’s Security Research team during an audit of Linux kernel patches addressing earlier DirtyFrag fixes. The core issue lies in the __pskb_copy_fclone() function, which drops the SKBFL_SHARED_FRAG safety flag during packet cloning, the same critical flag that the original DirtyFrag mitigation introduced to protect file-backed page cache memory. Unlike its predecessor, DirtyClone exploits a packet cloning path rather than a direct splice path, specifically triggered by the Linux netfilter TEE target that duplicates packets internally using __pskb_copy_fclone(). The vulnerability was independently reported by JFrog on May 19, 2026, coinciding with a broader upstream report from original DirtyFrag researcher Hyunwoo Kim on May 16. The DirtyFrag Vulnerability Family DirtyFrag, Fragnesia, and DirtyClone are sibling vulnerabilities, not a chain sharing the same underlying exploitation primitive. All three exploit the kernel’s failure to strictly separate three memory roles: file-backed page cache, networking buffers (skb), and in-place cryptographic transformations. Vulnerability CVE Disclosed Subsystem Write Primitive Root Required? Copy Fail CVE-2026-31431 April 30, 2026 algif_aead (AF_ALG crypto) 4-byte page-cache write No DirtyFrag CVE-2026-43284 / CVE-2026-43500 May 8, 2026 IPsec ESP (xfrm) + RxRPC Full write primitive (chained) No Fragnesia CVE-2026-46300 May 14, 2026 XFRM ESP-in-TCP Arbitrary byte write No pedit COW CVE-2026-46331 June 26, 2026 net/sched act_pedit Out-of-bounds page-cache write No The original DirtyFrag fix (CVE-2026-43284) introduced the SKBFL_SHARED_FRAG flag to protect spliced UDP packets, but subsequent variants like Fragnesia (CVE-2026-46300) and DirtyClone demonstrated that this flag could be silently dropped across multiple code paths. DirtyClone Linux Vulnerability The key insight from JFrog’s research is that the attack primitive is not path-specific; any skb transformation that drops the shared-frag marker becomes an exploitation vector. How the Attack Works The DirtyClone exploit chains seven steps to achieve privilege escalation: Map a privileged binary — The attacker memory-maps /usr/bin/su, loading it into the kernel’s page cache as the write target Splice page-cache memory into a packet — Using vmsplice and splice, the attacker attaches file-backed pages directly into a UDP socket buffer (skb) without copying Configure a loopback IPsec tunnel — A local XFRM/ESP tunnel is set up via unshare -Urn to obtain CAP_NET_ADMIN inside a user namespace, keeping all traffic kernel-local Trigger packet cloning via TEE — A netfilter TEE rule forces packet duplication through __pskb_copy_fclone(), creating a cloned skb that loses the SKBFL_SHARED_FRAG flag Force in-place IPsec decryption — The cloned skb reaches esp_input(), where IPsec decrypts the payload directly into the buffer — which still references the page cache page of /usr/bin/su Controlled overwrite using AES-CBC — By manipulating the encryption key, IV, and packet layout, the attacker computes ciphertext that decrypts into specific target bytes, patching authentication logic inside the binary’s in-memory copy Execute the modified binary — The next execution of su uses the modified cached page, bypassing authentication and granting root. The disk file remains entirely unchanged, making the attack invisible to file-integrity monitoring tools and leaving no kernel audit trail. Affected Systems CVE-2026-43503 affects a broad range of modern Linux distributions where unprivileged user namespaces are enabled: Debian — Vulnerable by default; unprivileged namespaces enabled Fedora — Vulnerable by default; unprivileged namespaces enabled Ubuntu — Partially mitigated on 24.04+ via AppArmor namespace restrictions, but still listed as affected Cloud and container environments — Kubernetes clusters, multi-tenant clouds, and containerized workloads with enabled user namespaces face the highest risk Any kernel lacking the complete DirtyFrag patch chain — including CVE-2026-46300 and CVE-2026-43503 fixes remains exploitable even if the original DirtyFrag patches were applied. The fix was merged into Linux mainline on May 21, 2026 (commit 48f6a5356a33), and the first fixed release tag is Linux v7.1-rc5 (May 24, 2026). The class-wide propagation fix ensures SKBFL_SHARED_FRAG is preserved across all skb copy/clone, coalesce, GRO receive, and segment paths. Immediate actions: Update the Linux kernel to v7.1-rc5 or apply the backported CVE-2026-43503 patch from your distribution. Restrict user namespaces by setting kernel.unprivileged_userns_clone=0 on Debian/Ubuntu systems. Blacklist kernel modules esp4, esp6, and rxrpc if IPsec is not in use to block the in-place decryption primitive. Drop page cache after applying mitigations (echo 3 > /proc/sys/vm/drop_caches) to evict any potentially tampered pages. No public PoC existed prior to JFrog’s research publication; JFrog has withheld the release of the full exploit code while distributions complete patch rollouts. What Features Should AI SOC Have? – Download Free 2026 AI SOC Features Checklist Tags cyber security cyber security news vulnerability Copy URL Linkedin Twitter ReddIt Telegram Guru Baranhttps://cybersecuritynews.com Gurubaran KS is a cybersecurity analyst, and Journalist with a strong focus on emerging threats and digital defense strategies. He is the Co-Founder and Editor-in-Chief of Cyber Security News, where he leads editorial coverage on global cybersecurity developments. Trending News Hackers Impersonate Node.js Installer in Google Ads to Deploy Infostealer Malware Hackers Use RemotePC RMM and PowerShell Stagers to Deploy Prinz Eugen Ransomware AWS Warns Outbound Traffic Blind Spots Can Enable Cloud Data Exfiltration Scattered Spider Hackers Who Breached London Transport Network Plead Guilty LokiBot Campaign Uses JScript Attachment, .NET Injector, and Process Injection to Steal Credentials Latest News Cyber Security New Linux pedit COW Exploit Allows Attackers to Gain System Root Access Cyber Security New Bluekit Phishing-as-a-Service Bypasses MFA to Steal Microsoft Login Credentials Cyber Security News Hackers Exploit Weak Credentials and Internet-Facing PLCs to Breach Water Utilities Cyber Security News New GIFTEDCROOK Chain Abuses WinRAR ADS and Reflective Loading to Steal Browser Data Cyber Security News Hackers Leveraged Shopify Oder-Tracking App Shop to Push Fake Invoices