Skip to main content
Meet us at Black Hat USA 2026— Las Vegas, August 1–6Book a Meeting
Mallory
HighPublic exploit

DirtyClone

IdentifiersCVE-2026-43503CWE-664

CVE-2026-43503 is a Linux kernel networking-stack vulnerability, publicly referred to as DirtyClone, caused by multiple sk_buff fragment-transfer and packet-processing helpers failing to preserve the SKBFL_SHARED_FRAG marker in skb_shinfo()->flags when fragment descriptors are moved between skbs. The primary affected helpers called out in the upstream fix are __pskb_copy_fclone() and skb_shift(); the same omission also existed in skb_gro_receive(), skb_gro_receive_list(), tcp_clone_payload(), and skb_segment(). Because the destination skb can continue to reference externally owned or page-cache-backed pages while skb_has_shared_frag() incorrectly returns false, later in-place writers may skip the required copy-on-write path via skb_cow_data(). The advisory specifically identifies ESP input processing in esp4.c and esp6.c as a reachable sink. With packet duplication via nft 'dup to <local>' or other nf_dup_ipv4()/xt_TEE callers, a pskb_copy()'d skb can reach esp_input() with the shared-frag marker stripped, enabling writes into page-cache-backed memory. Public reporting and exploit analysis describe this as a DirtyFrag-family local privilege escalation that can let an unprivileged local user corrupt the page cache of a root-owned read-only file and then execute the modified cached image to obtain root privileges.

Share:
For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can provide a local privilege-escalation path to root by allowing attacker-controlled in-place modification of file-backed page-cache memory that should have remained read-only. Public exploit reporting describes overwriting cached contents of privileged binaries such as /usr/bin/su without modifying the on-disk file, bypassing common file-integrity monitoring and leaving little or no kernel log or audit evidence. The upstream advisory also notes the possibility of unsafe writes through other affected skb paths, and vendor scoring reflects high confidentiality, integrity, and availability impact.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, reduce exploitability by preventing untrusted users from obtaining CAP_NET_ADMIN, including disabling or restricting unprivileged user namespaces where operationally feasible. Additional temporary mitigations described in the supporting content include blacklisting or disabling the esp4 and esp6 modules to remove the ESP in-place decryption sink, and blocking xt_TEE autoload or otherwise preventing TEE/nf_dup-based packet duplication paths. These are mitigations only and do not replace a kernel update.

Remediation

Patch, then assume compromise.

Upgrade to a Linux kernel release containing the upstream fix that propagates SKBFL_SHARED_FRAG through the affected helpers. The mainline fix is commit 48f6a5356a33, first present in v7.1-rc5, with stable backports issued across supported kernel branches. The fix sets or folds the shared-frag marker on destination skbs whenever fragment descriptors are moved, covering __pskb_copy_fclone(), skb_shift(), skb_gro_receive(), skb_gro_receive_list(), tcp_clone_payload(), and skb_segment(). Use vendor-provided kernel updates rather than cherry-picking individual patches where possible.
PUBLIC EXPLOITS

Exploits

4 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.

VALID 4 / 4 TOTALView more in app
CVE-2026-43503MaturityPoCVerified exploit

Single-file Python proof-of-concept for CVE-2026-43503 ('DirtyClone'), a local Linux kernel privilege-escalation issue involving page-cache manipulation through IPsec in-place decryption and packet cloning. The repository contains one executable script, dirtyclone_poc.py, which serves as the main and only entry point. The script is structured as a DirtyClonePoC class with helper methods for command execution, environment checks, namespace creation, IPsec/XFRM setup, iptables TEE configuration, target-file preparation, exploitation flow, verification, and cleanup. It uses subprocess calls to system tools such as uname, cat, ip, and iptables rather than implementing packet logic directly in Python. Core exploit capability: it attempts to create the kernel conditions needed to trigger the vulnerability by setting up an isolated network namespace, enabling loopback networking, assigning 10.99.0.2/24 to lo, configuring XFRM state/policy for ESP transport mode over 127.0.0.1, and installing an iptables mangle/OUTPUT TEE rule for UDP destination port 4500. This combination is intended to force packet cloning and exercise the vulnerable kernel path. The chosen target for page-cache manipulation defaults to /usr/bin/su, indicating the intended privilege-escalation objective. The visible code does not include a full post-trigger payload such as shell spawning, credential overwrite, or direct binary patch logic; instead it behaves as a demonstrative PoC that reports whether the vulnerability may have been triggered and states that a real exploit would modify page cache to allow privilege escalation. Because of that, the maturity is best classified as POC rather than operational weaponization. Notable fingerprintable artifacts include the namespace name dirtyclone_test, namespace path /var/run/netns/dirtyclone_test, kernel tunable /proc/sys/kernel/unprivileged_userns_clone, target binary /usr/bin/su, fallback file /tmp/vuln_test, loopback/XFRM endpoint 127.0.0.1, namespace IP 10.99.0.2, and UDP port 4500. Overall, this repository is a local kernel exploit PoC focused on reproducing vulnerability conditions rather than delivering a polished privilege-escalation payload.

sec0xDisclosed Jun 26, 2026pythonlocalnetwork
CVE-2026-43503-DirtyCloneMaturityPoCVerified exploit

This repository is a small standalone local privilege escalation exploit PoC for CVE-2026-43503 ('DirtyClone'). It contains two files: a README describing the vulnerability and affected Linux kernel versions, and a single Python exploit script, dirtyclone.py, which is the main entry point. The exploit is clearly intended for local execution on Linux, not remote exploitation. Its overall flow is: create a new user and network namespace, map the current user to UID/GID 0 inside the namespace, configure loopback networking, prepare XFRM/IPsec-related state, and then trigger a kernel memory corruption condition associated with clone/namespace handling. The script indicates use of kernel attack primitives to obtain an arbitrary write and overwrite credentials or otherwise hijack execution to gain root. Notable capabilities visible in the code include: - Namespace setup via unshare() using CLONE_NEWUSER and CLONE_NEWNET. - Writes to /proc/self/setgroups, /proc/self/uid_map, and /proc/self/gid_map to establish namespace privileges. - Loopback configuration using the ip command and assignment of 10.99.0.2/24 to lo. - Use of AF_ALG and XFRM/IPsec-related constants, suggesting the exploit abuses kernel crypto/IPsec plumbing as part of heap shaping or trigger logic. - A hardcoded target SUID binary (/usr/bin/su) and offset constant, implying a file overwrite or code-stomping stage against a privileged executable. - Embedded x86_64 shellcode that calls setgid(0), setuid(0), and execve('/bin/sh'). - Fallback/interactive root shell behavior via /bin/bash when already privileged. The repository appears to be more than a detector: it contains operational exploit logic and a real payload. Based on the visible code, it is best classified as an OPERATIONAL PoC rather than a framework-integrated or highly modular weaponized exploit. The script includes environment checks, troubleshooting guidance, and local system manipulation consistent with a practical LPE exploit.

aexdyhaxorDisclosed Jun 26, 2026markdownpythonlocal
CVE-2026-43503MaturityPoCVerified exploit

Repository contains a single C proof-of-concept exploit and a README describing the vulnerability. The exploit targets CVE-2026-43503 ('DirtyClone'), a Linux kernel local privilege escalation bug in networking/SKB fragment handling. The code is a standalone local exploit, not part of a framework. Structure: README.md provides vulnerability background, impact, and fixed kernel versions. CVE-2026-43503.c is the operational exploit entry point. It creates new user and network namespaces, writes /proc/self/{setgroups,uid_map,gid_map}, and brings up the loopback interface. It then interacts with the kernel XFRM/IPsec subsystem over NETLINK_XFRM, creating many security associations whose SPI/sequence-related values are derived from an embedded 192-byte ELF payload. The exploit appears to use a page-cache corruption/write primitive against /usr/bin/su, writing the payload in 4-byte chunks. After the corruption stage, it verifies expected bytes at a fixed entry offset and, on success, executes /usr/bin/su -c /bin/sh to obtain a root shell. Main capability: local privilege escalation to root by modifying the page cache of a root-owned executable (/usr/bin/su) and then invoking it. The payload is embedded and hardcoded rather than user-configurable, so the exploit is best classified as OPERATIONAL rather than weaponized. No external C2 or remote network infrastructure is present; all networking activity is local to the host, primarily loopback and kernel netlink/XFRM interactions.

0xBlackashDisclosed Jun 25, 2026cmarkdownlocal
dirtyclone-CVE-2026-43503MaturityPoCVerified exploit

This repository is a compact two-file local privilege escalation PoC for CVE-2026-43503 (DirtyClone). The main code is in CVE-2026-43503.py, with README.md providing a short vulnerability description, usage example, and prerequisites. The exploit is not part of a larger framework. The Python script targets a Linux kernel flaw involving cloned sk_buff handling during ESP-in-UDP processing. It creates new user and network namespaces with unshare(), configures loopback XFRM/IPsec state and policy using ip xfrm, and installs an iptables TEE rule to clone outbound UDP/4500 traffic toward 127.0.0.2. It then opens /etc/passwd read-only, derives crafted IVs using AES decryption with a static 16-byte key, and sends specially formed ESP-in-UDP packets over 127.0.0.1:4500 so that in-place decryption corrupts file-backed page-cache memory. The intended corruption replaces the beginning of /etc/passwd in cache with a new root-level account entry. The hardcoded payload injects account 'firefart' with password 'pwned' and a preset SHA-512 hash, preserving the original root line and appending a second UID 0 entry. After the overwrite attempt, the script checks whether the account is visible through the system password database, runs 'su' with the known password to execute 'id', and if successful offers an interactive root shell via /bin/bash on a PTY. Capabilities include: local kernel exploitation, namespace setup, XFRM/IPsec and iptables manipulation, page-cache-only modification of /etc/passwd, creation of a usable UID 0 account, privilege verification, and interactive root shell access. There are no external internet endpoints; all network activity is local loopback traffic using 127.0.0.1/127.0.0.2 and UDP port 4500.

mooder1Disclosed Jun 26, 2026pythonmarkdownlocalnetwork
EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType
DebianLinuxapplication
LinuxLinux Kerneloperating_system

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

58 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.
Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity38

Community discussion across Reddit, Mastodon, and other social sources.