Linux Kernel Local Privilege Escalation Vulnerability “DirtyClone” (CVE-2026-43503)

A variant of recently disclosed Dirty Frag, namely “DirtyClone” (with CVE-2026-43503), has been identified in the Linux kernel’s networking stack, specifically in socket buffer (sk_buff) fragment handling. The vulnerability could allow a local unprivileged attacker to corrupt page-cache-backed memory and obtain root-level privileges on affected Linux systems. System owners are strongly advised to review affected systems and apply the latest kernel security updates ASAP to reduce potential risks.

Vulnerability

• Linux Kernel Local Privilege Escalation Vulnerability “DirtyClone” (CVE-2026-43503)
  • The flaw stems from improper propagation of the SKBFL_SHARED_FRAG marker when socket buffer fragments are transferred, which causes file-backed or externally owned memory pages to be treated as safely writable.
  • Successful exploitation allows a local attacker to write into the page cache of root-owned read-only files, potentially escalating privileges or escaping a container.

Severity Level

• High

Affected Versions

Remediation

• Apply the latest patched kernel from your distribution vendor (The vulnerability was patched in upstream Linux kernel v7.1-rc5 with commit 48f6a5356a33).
• Reboot the system after applying the kernel update to ensure the patched kernel is in use.
• Restrict exposure to IPsec / XFRM-related functionality and unprivileged user namespaces.
• Review container and namespace configurations.

Reference

• NVD: CVE-2026-43503
• Ubuntu: CVE-2026-43503
• Debian: CVE-2026-43503
• SUSE: CVE-2026-43503
• Amazon Linux Security Center: CVE-2026-43503
• Linux Kernel Stable Tree: propagate shared-frag marker through frag-transfer helpers
• The Hacker News: New DirtyClone Linux Kernel Flaw Lets Local Users Gain Root via Cloned Packets
• Hong Kong Linux User Group: Critical DirtyClone Flaw Lets Unprivileged Users Escalate to Root on Linux

Published on: 29 June 2026