Vulnerability Overview

Disclosed in late May 2026, DirtyClone (CVE-2026-43503) is a critical local privilege escalation (LPE) vulnerability that belongs to the same family of page-cache corruption vulnerabilities as CopyFail, DirtyFrag, and Fragnesia.

By exploiting a logic flaw in how the Linux kernel handles page ownership for cloned socket buffers (sk_buff or skb), a local attacker can write arbitrary data directly into read-only system files stored in the kernel's Page Cache. This modification occurs entirely in physical memory, bypassing file system write protections and disk-based audit mechanisms. Attackers can overwrite common setuid binaries (like /usr/bin/su or /usr/bin/sudo) in memory to spawn an interactive root shell.

Technical Details

The root cause of DirtyClone lies in the kernel's memory management and network buffer cloning subsystems. When the kernel clones a network packet using helper functions, it creates a copy of the buffer headers while keeping reference counts to the underlying data pages (fragments).

If these fragments are backed by a file mapped via the splice() or sendfile() system calls, they must be marked as shared and immutable using the SKBFL_SHARED_FRAG flag.

In vulnerable kernels, certain helper functions failed to propagate the SKBFL_SHARED_FRAG marker to cloned buffers. As a result, subsequent inline modifications (such as IPSec ESP decryption or socket operations) assumed exclusive ownership of the page and modified the data in-place without triggering a Copy-on-Write (COW) operation. Because the page was actually still shared with the page cache, the modification corrupted the cached copy of the file in memory.

Technical Exploit Flow

Mitigation & Remediation

System administrators and cloud operators should patch host operating systems immediately.

1. Update Linux Kernel

Apply the security updates from your Linux distribution. The mainline patch ensures that SKBFL_SHARED_FRAG is properly set and propagated during socket buffer cloning operations.

Ubuntu / Debian:

sudo apt update && sudo apt upgrade linux-image-generic -y
sudo reboot

RHEL / Rocky Linux:

sudo dnf update kernel -y
sudo reboot

2. Restrict Unprivileged User Namespaces (Mitigation)

Since the exploit typically requires local network administration capabilities (CAP_NET_ADMIN) to configure specific IPsec policies or socket filters, disabling unprivileged user namespaces blocks the attack vector.

To apply this mitigation immediately:

sudo sysctl -w kernel.unprivileged_userns_clone=0

To make the setting persistent across reboots, add it to /etc/sysctl.d/:

echo "kernel.unprivileged_userns_clone=0" | sudo tee /etc/sysctl.d/99-disable-userns.conf

(Note: Disabling namespaces may break rootless container environments such as rootless Podman or rootless Docker.)