New DirtyClone Linux Vulnerability Allows Attackers to Gain Root Access Via Cloned Packets

Cybersecuritynews •Guru Baran • June 26, 2026

A new Linux kernel local privilege escalation vulnerability, dubbed “DirtyClone” (CVE-2026-43503), that allows unprivileged local users to gain full root access by manipulating cloned network packets through the XFRM/IPsec subsystem, all without leaving a trace in kernel logs or audit records. DirtyClone is a high-severity variant in the DirtyFrag vulnerability family, a class of Linux […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New DirtyClone Vulnerability in Linux Kernel Enables Local Privilege Escalation Two critical vulnerabilities in the Linux kernel have been disclosed, including DirtyClone (CVE-2026-43503) and another local privilege escalation flaw (CVE-2026-46331). DirtyClone allows local users to gain root access by manipulating cloned network packets, exploiting a flaw in the XFRM/IPsec subsystem. This vulnerability was confirmed to affect popular Linux distributions like Debian, Ubuntu, and Fedora. The first proof-of-concept for DirtyClone was published on June 26, 2026, and it is part of the DirtyFrag vulnerability family. The second vulnerability, CVE-2026-46331, involves an out-of-bounds write flaw in the traffic control packet editing subsystem, also leading to potential page cache corruption. Both vulnerabilities have been patched, but immediate action is recommended for those unable to apply updates. JFrog Security Research has provided detailed exploit walkthroughs for both vulnerabilities. 16 sources 74

Extracted Entities

New DirtyClone Linux Vulnerability Allows Attackers to Gain Root Access Via Cloned Packets

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

Platforms (1)

Vulnerabilities (1)