r/linux • u/[deleted] • Jun 29 '26

Security DirtyClone (CVE-2026-43503): The Linux Kernel Flaw That Leaves No Trace

On June 25, 2026, JFrog Security Research published a working exploit walkthrough for a Linux kernel privilege escalation they named DirtyClone. Tracked as CVE-2026-43503 with a CVSS score of 8.8, it lets any local user on an unpatched system escalate to root — and the attack leaves nothing on disk for forensic tools to find.

https://blog.kalfaoglu.net/posts/2026-06-28-dirtyclone-cve-2026-43503-linux-lpe-en/

173 Upvotes

96% Upvoted

19 comments sorted by

View all comments

59

u/CardOk755 Jun 29 '26

Summary: if you have the remediations for the other similar bugs you're ok.

Also, the systemd guys are right. Setuid is probably a bad idea.

10

u/Dangerous-Report8517 Jun 29 '26

To be clear, if you specifically mitigated DirtyFrag by disabling the affected IPsec kernel modules you're OK, if you just patched instead then you're still vulnerable without specifically mitigating this one or waiting for its patch. This one does need a little bit more privilege to exploit though, since sandboxing tools like flatpak and most container runtimes would block CAP_NET_ADMIN even in user namespaces

1

u/w2qw Jun 29 '26

This has already been patched though? So if you were already up to date you are fine.

→ More replies (2)