New DirtyClone Linux Vulnerability Allows Attackers to Gain Root Access Via Cloned Packets

A new Linux kernel local privilege escalation vulnerability, dubbed “DirtyClone” (CVE-2026-43503), that allows unprivileged local users to gain full root access by manipulating cloned network packets through the XFRM/IPsec subsystem, all without leaving a trace in kernel logs or audit records.

DirtyClone is a high-severity variant in the DirtyFrag vulnerability family, a class of Linux kernel memory corruption bugs affecting how socket buffers (skb) reference shared page-cache memory.

Tracked as CVE-2026-43503, uncovered by JFrog Security Research with a CVSS score of 8.8, it was discovered by JFrog’s Security Research team during an audit of Linux kernel patches addressing earlier DirtyFrag fixes.

The core issue lies in the __pskb_copy_fclone() function, which drops the SKBFL_SHARED_FRAG safety flag during packet cloning, the same critical flag that the original DirtyFrag mitigation introduced to protect file-backed page cache memory.

Unlike its predecessor, DirtyClone exploits a packet cloning path rather than a direct splice path, specifically triggered by the Linux netfilter TEE target that duplicates packets internally using __pskb_copy_fclone().

The vulnerability was independently reported by JFrog on May 19, 2026, coinciding with a broader upstream report from original DirtyFrag researcher Hyunwoo Kim on May 16.

The DirtyFrag Vulnerability Family

DirtyFrag, Fragnesia, and DirtyClone are sibling vulnerabilities, not a chain sharing the same underlying exploitation primitive. All three exploit the kernel’s failure to strictly separate three memory roles: file-backed page cache, networking buffers (skb), and in-place cryptographic transformations.

The original DirtyFrag fix (CVE-2026-43284) introduced the SKBFL_SHARED_FRAG flag to protect spliced UDP packets, but subsequent variants like Fragnesia (CVE-2026-46300) and DirtyClone demonstrated that this flag could be silently dropped across multiple code paths.

The key insight from JFrog’s research is that the attack primitive is not path-specific; any skb transformation that drops the shared-frag marker becomes an exploitation vector.

How the Attack Works

The DirtyClone exploit chains seven steps to achieve privilege escalation:

1. Map a privileged binary — The attacker memory-maps /usr/bin/su, loading it into the kernel’s page cache as the write target
2. Splice page-cache memory into a packet — Using vmsplice and splice, the attacker attaches file-backed pages directly into a UDP socket buffer (skb) without copying
3. Configure a loopback IPsec tunnel — A local XFRM/ESP tunnel is set up via unshare -Urn to obtain CAP_NET_ADMIN inside a user namespace, keeping all traffic kernel-local
4. Trigger packet cloning via TEE — A netfilter TEE rule forces packet duplication through __pskb_copy_fclone(), creating a cloned skb that loses the SKBFL_SHARED_FRAG flag
5. Force in-place IPsec decryption — The cloned skb reaches esp_input(), where IPsec decrypts the payload directly into the buffer — which still references the page cache page of /usr/bin/su
6. Controlled overwrite using AES-CBC — By manipulating the encryption key, IV, and packet layout, the attacker computes ciphertext that decrypts into specific target bytes, patching authentication logic inside the binary’s in-memory copy
7. Execute the modified binary — The next execution of su uses the modified cached page, bypassing authentication and granting root.

The disk file remains entirely unchanged, making the attack invisible to file-integrity monitoring tools and leaving no kernel audit trail.

Affected Systems

CVE-2026-43503 affects a broad range of modern Linux distributions where unprivileged user namespaces are enabled:

• Debian — Vulnerable by default; unprivileged namespaces enabled
• Fedora — Vulnerable by default; unprivileged namespaces enabled
• Ubuntu — Partially mitigated on 24.04+ via AppArmor namespace restrictions, but still listed as affected
• Cloud and container environments — Kubernetes clusters, multi-tenant clouds, and containerized workloads with enabled user namespaces face the highest risk

Any kernel lacking the complete DirtyFrag patch chain — including CVE-2026-46300 and CVE-2026-43503 fixes remains exploitable even if the original DirtyFrag patches were applied.

The fix was merged into Linux mainline on May 21, 2026 (commit 48f6a5356a33), and the first fixed release tag is Linux v7.1-rc5 (May 24, 2026). The class-wide propagation fix ensures SKBFL_SHARED_FRAG is preserved across all skb copy/clone, coalesce, GRO receive, and segment paths.

Immediate actions:

• Update the Linux kernel to v7.1-rc5 or apply the backported CVE-2026-43503 patch from your distribution.
• Restrict user namespaces by setting kernel.unprivileged_userns_clone=0 on Debian/Ubuntu systems.
• Blacklist kernel modules esp4, esp6, and rxrpc if IPsec is not in use to block the in-place decryption primitive.
• Drop page cache after applying mitigations (echo 3 > /proc/sys/vm/drop_caches) to evict any potentially tampered pages.

No public PoC existed prior to JFrog’s research publication; JFrog has withheld the release of the full exploit code while distributions complete patch rollouts.

What Features Should AI SOC Have? – Download Free 2026 AI SOC Features Checklist