JFrog has published technical details and a proof-of-concept exploit for a high-severity Linux kernel vulnerability that lets any local user escalate to root privileges.
Tracked as CVE-2026-43503 with a CVSS score of 8.8, the flaw is called DirtyClone. It’s a variant of DirtyFrag and Fragnesia — two related bugs patched in mid-May — and shares DNA with 2022’s Dirty Pipe. All of them exploit the same core problem: the kernel doesn’t properly separate page-cache memory used for executables and files from packet data processed through zero-copy paths.
Here’s how it works. When socket buffers reference shared page-cache memory and in-place cryptographic transformations write back to the same buffer, the kernel can end up modifying file-backed data it shouldn’t touch. That’s your corruption vector. An unprivileged local user with CAP_NET_ADMIN capability can weaponize this to gain root.
The fix for DirtyFrag set a metadata flag for spliced UDP packets. The Fragnesia patch ensured that flag propagates across functions. DirtyClone bypassed those mitigations.
Updating to Linux kernel v7.1-rc5 blocks the exploit — but only if you’ve applied the complete chain of fixes. Systems unpatched for the original flaws (CVE-2026-43284 and CVE-2026-43500) are still exposed. Any kernel branch that got the initial mitigations but lacks the follow-up patches (CVE-2026-46300 and CVE-2026-43503) remains vulnerable to specific bypasses.
Distributions that enable unprivileged user namespaces — Debian, Fedora, Ubuntu — are affected. Multi-tenant cloud environments, Kubernetes clusters, and containerized workloads face the highest risk.
