DirtyClone (CVE-2026-43503): Local Privilege Escalation in the Linux Kernel

Colleagues, a critical kernel vulnerability—DirtyClone (CVE-2026-43503)—has been discovered.

Summary:
— JFrog published an exploit: cloning a package drops the shared-frag flag, allowing modification of file-backed binaries in memory (e.g. /usr/bin/su) to obtain root.
— Exploitation requires CAP_NET_ADMIN in a namespace; Debian and Fedora with unprivileged namespaces enabled are affected; Ubuntu 24.04 partially mitigates via AppArmor.
— Mainline patch landed (v7.1-rc5, 21 May) and backports are available — update kernels. Mitigations: kernel.unprivileged_userns_clone=0 or blocking esp4/esp6/rxrpc modules.

Impact: risk to multi-tenant servers, CI, container hosts and Kubernetes.

How will you respond?
#cybersecurity #Linux #vulnerabilities #kernel