New Dirty Clone Linux Kernel Flaw Lets Local Users Gain Root via Cloned Packets
Summary: JFrog Security Research published a working exploit walkthrough on June 25 for DirtyClone, a Linux kernel privilege escalation tracked as CVE-2026-43503 (CVSS 8.8) that lets a local user gain root by corrupting file-backed memory through a cloned network packet. The flaw occurs when two kernel helper functions drop a safety flag marking packet memory as shared with a file on disk, and the patch landed in mainline on May 21, shipping in Linux v7.1-rc5 on May 24.
Key Takeaway: The modification lives only in the kernel's in-memory copy, so file-integrity tools miss it, the attack leaves no audit trail, and a reboot restores the original binary - meaning the attacker already has root by the time anyone might think to check. JFrog confirmed the exploit on Debian, Ubuntu, and Fedora systems with default namespace configurations, and this is the fourth recent privilege escalation with the same failure mode.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-43503
- Related
- ⚡ Weekly Recap: Linux Kernel Flaws, AI Malware Tricks, Turla Backdoor, Infostealers and More Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026