⚡ Weekly Recap: Linux Kernel Flaws, AI Malware Tricks, Turla Backdoor, Infostealers and More

Summary: This week's recap details DirtyClone (CVE-2026-43503), a new variant of the Dirty Frag Linux kernel flaw that lets local users gain root privileges via cloned packets, working on Debian, Ubuntu, and Fedora with default namespace configurations. JFrog said any local user holding or able to acquire CAP_NET_ADMIN, often via unprivileged user namespaces, is exploitable, posing the highest risk to multi-tenant cloud environments, Kubernetes clusters, and containerized workloads.
Bottom line: JFrog's assessment puts multi-tenant cloud, Kubernetes, and containerized workloads with user namespaces enabled at the top of the risk list, where a local user who can acquire CAP_NET_ADMIN turns a single unpatched kernel into root.

Read the original at The Hacker News ↗