Back Feeds.4Sysops

DirtyClone vulnerability allows local root escalation via Linux kernel packet cloning

Feeds.4Sysops •IT News • June 26, 2026

A newly discovered Linux kernel vulnerability, tracked as CVE-2026-43503 and dubbed DirtyClone, enables local users to achieve root privileges. This flaw belongs to the DirtyFrag family of vulnerabilities and centers on the corruption of file-backed memory. By leveraging cloned network packets, an attacker can bypass standard permission boundaries to modify sensitive system data. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New DirtyClone Vulnerability in Linux Kernel Enables Local Privilege Escalation Two critical vulnerabilities in the Linux kernel have been disclosed, including DirtyClone (CVE-2026-43503) and another local privilege escalation flaw (CVE-2026-46331). DirtyClone allows local users to gain root access by manipulating cloned network packets, exploiting a flaw in the XFRM/IPsec subsystem. This vulnerability was confirmed to affect popular Linux distributions like Debian, Ubuntu, and Fedora. The first proof-of-concept for DirtyClone was published on June 26, 2026, and it is part of the DirtyFrag vulnerability family. The second vulnerability, CVE-2026-46331, involves an out-of-bounds write flaw in the traffic control packet editing subsystem, also leading to potential page cache corruption. Both vulnerabilities have been patched, but immediate action is recommended for those unable to apply updates. JFrog Security Research has provided detailed exploit walkthroughs for both vulnerabilities. 16 sources 74

Extracted Entities

DirtyClone vulnerability allows local root escalation via Linux kernel packet cloning

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

MITRE ATT&CK (1)

Platforms (1)

Vulnerabilities (1)