Security researchers at Rescana disclosed CVE-2026-43503 on June 28, 2026 — a local privilege escalation vulnerability in the Linux kernel’s packet cloning subsystem that affects virtually every distribution running a kernel between versions 6.1 and 6.12. The vulnerability has been nicknamed “DirtyClone” due to its similarity to the 2022 DirtyPipe exploit in terms of impact and attack surface.
Here’s what you need to know and, more importantly, what you need to do right now.
What DirtyClone Actually Does
The vulnerability exists in the skb_clone() function within the kernel’s networking stack. When a network packet is cloned for multiple recipients (common in bridge, multicast, and tcpdump scenarios), a race condition in the clone operation can leave a cloned packet with a dangling reference to freed kernel memory. A local attacker who triggers this race condition can read or write to kernel memory that should be inaccessible.
The practical impact: any local user on an affected system can escalate to root privileges. The attack requires the ability to execute code locally — it is not remotely exploitable on its own — but combined with any remote code execution vulnerability (including common web application flaws), it becomes a full system compromise chain.
Affected kernels: Linux 6.1.0 through 6.12.7 (the vulnerability was introduced in a refactor of the net/core/skbuff.c file in kernel 6.1).
CVSS Score: 7.8 (High) — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Step 1: Check If You’re Vulnerable
# Check your kernel version
uname -r
# Check if the vulnerability is patched
grep -q "CVE-2026-43503" /sys/kernel/security/vulnerabilities/* 2>/dev/null && \
echo "PATCHED" || echo "NEEDS CHECKING"
# If the above doesn't work, verify your kernel version directly
kernel_version=$(uname -r | cut -d. -f1,2)
if (( $(echo "$kernel_version >= 6.1" | bc -l) )) && \
(( $(echo "$kernel_version <= 6.12" | bc -l) )); then
echo "WARNING: Kernel $kernel_version is in the vulnerable range"
else
echo "Kernel $kernel_version is outside the known vulnerable range"
fiStep 2: Apply the Patch
The fix is a one-line change in net/core/skbuff.c that adds a missing reference count check. All major distributions have shipped patched kernels.
Ubuntu/Debian
sudo apt update && sudo apt upgrade -y
sudo apt install --only-upgrade linux-image-$(uname -r) linux-headers-$(uname -r)
sudo rebootRHEL/Rocky/AlmaLinux 9
sudo dnf update kernel -y
sudo rebootAmazon Linux 2023
sudo dnf update kernel -y
sudo rebootImportant: A reboot is required. Kernel live-patching services like Canonical Livepatch and KernelCare have released patches that don’t require a reboot, but the safest approach is to schedule a maintenance window and reboot.
Step 3: Mitigation If You Can’t Patch Immediately
If you can’t reboot right now, apply these mitigations to reduce the attack surface:
Restrict user namespaces
User namespaces are the most common path to triggering kernel exploits from an unprivileged context.
# On Ubuntu/Debian
echo 'kernel.unprivileged_userns_clone = 0' | sudo tee /etc/sysctl.d/99-cve-2026-43503.conf
sudo sysctl -p /etc/sysctl.d/99-cve-2026-43503.conf
# On RHEL/Rocky/Alma
echo 'user.max_user_namespaces = 0' | sudo tee /etc/sysctl.d/99-cve-2026-43503.conf
sudo sysctl -p /etc/sysctl.d/99-cve-2026-43503.confRestrict BPF
The public proof-of-concept exploit uses eBPF to trigger the race condition reliably.
echo 'kernel.unprivileged_bpf_disabled = 1' | sudo tee -a /etc/sysctl.d/99-cve-2026-43503.conf
sudo sysctl -p /etc/sysctl.d/99-cve-2026-43503.confMonitor for exploitation attempts
# Watch for unusual skb_clone activity
sudo bpftrace -e 'kprobe:skb_clone { printf("skb_clone called by PID %d (%s)\n", pid, comm); }'Step 4: Container and Kubernetes Considerations
If you’re running containers, patching the host kernel is sufficient — containers share the host kernel and don’t need individual patches. However, if you’re using a managed Kubernetes service:
- EKS: AWS has auto-updated managed node groups with the patched AMI. Verify your nodes are running the latest AMI release.
- GKE: Google released node image
cos-109-17800-0-54with the fix. Check your node pool’s auto-upgrade settings. - AKS: Microsoft patched this in the July 2026 security update. If you’re on a version before 1.30.5, upgrade.
For self-managed clusters, update your node images and roll nodes one at a time.
What Happens If You Ignore This
Historical precedent is not reassuring. DirtyPipe (CVE-2022-0847) — a very similar privilege escalation bug — was exploited in the wild within 72 hours of disclosure. The same pattern held for CVE-2023-0386 and CVE-2024-1086. Local privilege escalation vulnerabilities in the Linux kernel have a predictable lifecycle: disclosure → PoC published within hours → weaponized exploit in ransomware campaigns within days.
If your servers are internet-facing and run any service that executes user-supplied code (web applications, CI/CD runners, SSH with shell access for multiple users), patch this today. The math is not in your favor.
