Researchers at JFrog Security have uncovered a new privilege escalation vulnerability in the Linux kernel, which is part of the broader DirtyFrag and has the potential to grant a local user full administrator privileges. The new variant, dubbed DirtyClone and tracked as CVE-2026-43503, is rated with a CVSS severity score of 8.8 and is considered one of the most significant vulnerabilities to be discovered in the operating system this year.
The first public technical analysis was published on June 25, while the fix had already been integrated into the mainline Linux development pipeline since May 21.Experts warn that systems that have not installed the relevant updates remain exposed to attacks that can lead to a complete system compromise.
See also: 9-year-old Linux Kernel vulnerability allows root access
How DirtyClone works
The vulnerability relates to the way the Linux kernel handles internal network packet replication. Under certain conditions, the mechanism that handles cloned packets fails to set a critical safety flag, which indicates that the memory used is associated with data stored in files on disk.
This seemingly small omission allows an attacker to modify data that should normally be considered protected.
In the scenario presented by the researchers, the attacker loads a privileged binary, such as /usr/bin/su, then links the relevant memory pages to a network packet and forces the kernel to execute it. The cloned packet passes through an IPsec tunnel controlled by the attacker, and during the decryption process, specific bytes of the executable file are replaced with code of the attacker's choosing.
The result is impressive: the next time a user executes the su command, the system can grant root privileges to the attacker.
The attack leaves almost no footprint
One of the most worrying features of DirtyClone is its difficulty in detection. The original file on disk is never modified. The changes are made exclusively in kernel memory, which means that traditional file integrity checking tools do not detect a violation. Furthermore, the attack does not create any visible log traces, and a simple reboot restores the executable to its original state.
See also: Vulnerability in Ubuntu Kernel allows Root access
This means that an attacker can temporarily gain administrator privileges, perform their actions, and disappear without any visible traces of system tampering.
Which systems are most at risk?
Exploiting the vulnerability requires the existence of CAP_NET_ADMINso that the attacker can create the necessary IPsec tunnel.
In distributions like Debian and Fedora, unprivileged user namespaces are enabled by default, allowing a local user to gain that particular capability within a new namespace.
In contrast, newer versions of Ubuntu implement additional restrictions through AppArmor, making the basic exploit chain more difficult.
Experts believe that multi-tenant servers, CI runners, container hosts , and Kubernetes clusters, where untrusted users have the ability to create namespaces.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
DirtyClone is the continuation of a larger family of vulnerabilities
The new discovery is the fourth serious vulnerability in the DirtyFrag family in a short period of time.
It was preceded by the Copy Fail vulnerability CVE-2026-31431, followed by DirtyFrag with CVE-2026-43284 and CVE-2026-43500, and then Fragnesia, which managed to bypass previous fixes.
The recurring pattern shows that the problem is not limited to a faulty kernel function. The real weakness lies in the way various Linux networking subsystems manage memory.
See also: CISA: Linux Kernel vulnerability used for ransomware attacks
The zero-copy networking philosophy, which was designed to offer high performance by avoiding unnecessary data copying, seems to create unpredictable consequences when even a safety flag is omitted during data transfer.
What should system administrators do?
Experts recommend installing available security updates. The relevant fix has already been integrated into the latest versions of the Linux kernel and has been ported to the stable and LTS branches.
For those who cannot immediately update their systems, temporary measures to reduce the attack surface are recommended, such as disabling unprivileged user namespaces and disabling specific IPsec subsystems where possible.
Despite the available fixes, researchers warn that the DirtyFrag story is likely not over. DirtyClone is not just another vulnerability, but an indication of a deeper architectural problem in the way modern Linux works.
pedit COW: Second vulnerability in Linux Kernel
Another vulnerability in the Linux kernel's traffic-control subsystem could allow a local unprivileged user to gain root access on affected systems.
CVE -2026-46331, nicknamed “pedit COW,” is an “out-of-bounds write” vulnerability in the packet-editing action (act_pedit), which corrupts shared page-cache memory. A public, functional exploit appeared within a day of the CVE assignment on June 16. Red Hat rates the flaw as important.
The exploit never touches the file on disk. It poisons the cached copy of a setuid root binary (/bin/su) in memory, injects a small payload, and executes this modified image as root. File integrity checks return clean while a root shell is already open.
The exploit requires two things: act_pedit to be loadable and unprivileged user namespaces to be open, giving the attacker a namespace-local networking capability (CAP_NET_ADMIN) required to trigger the flaw. On the tested RHEL and Debian targets, both conditions were present.
Affected Systems – Fixes
- Debian has patched trixie through its security channel. Debian 11 and 12 are still listed as vulnerable.
- Ubuntu lists supported versions from 18.04 to 26.04 as vulnerable as of June 25th.
- Red Hat lists RHEL 8, 9, and 10 as affected. RHEL 7 is not mentioned in the bulletin.
