cyber.hendryadrian.com
Vulnerability & Exploit · securityweek.com

DirtyClone Linux Kernel Flaw Can Enable Local Root Access

· Original article ↗

Summary

JFrog details DirtyClone (CVE-2026-43503), a Linux kernel flaw that can enable local privilege escalation. Protection requires the complete chain of fixes; affected systems include some Debian, Fedora and Ubuntu configurations.

Key points

  • JFrog says DirtyClone, tracked as CVE-2026-43503 with a CVSS score of 8.8, could let a local user gain root privileges.
  • Exploitation requires CAP_NET_ADMIN on an affected kernel, according to the article.
  • JFrog describes DirtyClone as part of a broader vulnerability family involving socket buffers, shared page-cache memory and in-place transformations.
  • Linux kernel v7.1-rc5 includes fixes that prevent DirtyClone exploitation; systems need the complete chain of fixes for the DirtyFrag vulnerability family.
  • Kernels missing fixes for CVE-2026-43284, CVE-2026-43500, CVE-2026-46300 or CVE-2026-43503 may remain exposed to the described flaws or bypasses.
  • The article identifies Debian, Fedora and Ubuntu systems that enable unprivileged user namespaces, and multi-tenant cloud, Kubernetes and container environments, as potentially affected.

Article Details

Vulnerability Types
  • Memory corruption
  • Local privilege escalation
Severity
High (CVSS 8.8)
Exploitation Status
unknown
Exploit Availability
public_poc
Patch Status
available
Workarounds
  • Update to Linux kernel v7.1-rc5 or ensure the complete chain of fixes for the DirtyFrag vulnerability family is applied.

MITRE ATT&CK

T1068 · Exploitation for Privilege EscalationDirtyClone can be exploited by a local user with CAP_NET_ADMIN to gain root privileges.

CVE

CVE-2026-43284“Systems entirely unpatched for the original flaws (CVE-2026-43284 and CVE-2026-43500) remain broadly exposed.CVE-2026-43500“Systems entirely unpatched for the original flaws (CVE-2026-43284 and CVE-2026-43500) remain broadly exposed.CVE-2026-43503Tracked as CVE-2026-43503 (CVSS score of 8.8) and referred to as DirtyClone, the local privilege escalation bug was resolved on May 24, shortly after being reported to the Linux kernel maintainers.CVE-2026-46300(LTS) kernel branch that applied the initial mitigations but lacks the subsequent follow-up patches (CVE-2026-46300 and CVE-2026-43503) remains vulnerable to specific bypasses,” JFrog explains.

Products

Debian LinuxPopular Linux distributions that enable unprivileged user namespaces, such as Debian, Fedora, and Ubuntu, are affected.FedoraPopular Linux distributions that enable unprivileged user namespaces, such as Debian, Fedora, and Ubuntu, are affected.Linux kernelJFrog has published technical details and a proof of concept (PoC) targeting a recent high-severity Linux kernel vulnerability that could allow any local user to gain root privileges.UbuntuPopular Linux distributions that enable unprivileged user namespaces, such as Debian, Fedora, and Ubuntu, are affected.

Related Articles