Back Securityaffairs.Co

DirtyClone: Fourth Linux Kernel Flaw in Six Weeks Escalates to Root

Securityaffairs.Co •Pierluigi Paganini • June 27, 2026

DirtyClone: a Linux kernel privilege escalation that silently rewrites executables in memory, leaving no disk trace. Patch now. JFrog Security Research published a working exploit walkthrough on June 25 for CVE-2026-43503 (CVSS score of 8.8), a Linux kernel privilege escalation they call DirtyClone. It’s the fourth vulnerability in the DirtyFrag family, all sharing the same […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New DirtyClone Vulnerability in Linux Kernel Enables Local Privilege Escalation Two critical vulnerabilities in the Linux kernel have been disclosed, including DirtyClone (CVE-2026-43503) and another local privilege escalation flaw (CVE-2026-46331). DirtyClone allows local users to gain root access by manipulating cloned network packets, exploiting a flaw in the XFRM/IPsec subsystem. This vulnerability was confirmed to affect popular Linux distributions like Debian, Ubuntu, and Fedora. The first proof-of-concept for DirtyClone was published on June 26, 2026, and it is part of the DirtyFrag vulnerability family. The second vulnerability, CVE-2026-46331, involves an out-of-bounds write flaw in the traffic control packet editing subsystem, also leading to potential page cache corruption. Both vulnerabilities have been patched, but immediate action is recommended for those unable to apply updates. JFrog Security Research has provided detailed exploit walkthroughs for both vulnerabilities. 16 sources 74

Extracted Entities

DirtyClone: Fourth Linux Kernel Flaw in Six Weeks Escalates to Root

The full story

Extracted Entities

CVEs (1)

MITRE ATT&CK (1)

Platforms (1)

Vulnerabilities (2)