---

📖 Overview

CVE-2026-43503, nicknamed DirtyClone, is a High Severity Local Privilege Escalation (LPE) vulnerability affecting the Linux kernel networking subsystem.

The vulnerability exists because several Socket Buffer (SKB) fragment-copy routines fail to preserve the SKBFL_SHARED_FRAG flag when cloning or transferring packet fragments.

As a result, memory that should remain protected by Copy-on-Write (CoW) semantics may become writable unexpectedly, allowing a local attacker to modify read-only page-cache data under specific conditions.

---

⚡ Why "DirtyClone"?

The name DirtyClone reflects two key characteristics:

• Dirty → Shared page-cache memory becomes unexpectedly writable.
• Clone → Triggered during cloning or transferring SKB fragments.

Similar to previous Linux memory corruption vulnerabilities, the issue stems from incorrect handling of shared memory metadata rather than a traditional buffer overflow.

---

🎯 Impact

Successful exploitation may allow an attacker to:

• 🔺 Escalate privileges to root
• 🛠 Modify root-owned read-only files
• 💾 Corrupt page-cache backed memory
• ⚠ Bypass expected Copy-on-Write protections
• 🔥 Execute arbitrary code with elevated privileges (depending on exploit chain)

---

🧩 Root Cause

Several networking helper functions clone or move packet fragments without copying the:

SKBFL_SHARED_FRAG

flag.

Consequently, the destination socket buffer incorrectly assumes ownership of memory that is actually shared.

This breaks the kernel's assumptions about page ownership and write protection.

---

🔬 Affected Functions

__pskb_copy_fclone()

skb_shift()

skb_gro_receive()

skb_gro_receive_list()

tcp_clone_payload()

skb_segment()

Each of these routines may propagate fragment references without preserving the shared-fragment state.

---

💥 Attack Flow

Local User
     │
     ▼
Create crafted networking workload
     │
     ▼
SKB Fragment Cloning
     │
     ▼
SKBFL_SHARED_FRAG Lost
     │
     ▼
Shared Memory Appears Private
     │
     ▼
Write Into Read-Only Page Cache
     │
     ▼
Privilege Escalation

---

📸 Demo

---

📊 Vulnerability Details

Property	Value
CVE	CVE-2026-43503
Nickname	DirtyClone
Severity	High
CVSS v3.1	8.8
Attack Vector	Local
Complexity	Low
Privileges Required	Low
User Interaction	None
Scope	Changed
Impact	Privilege Escalation

---

🖥 Affected Component

Linux Kernel

Subsystem:
net/skbuff

---

✅ Fixed Kernel Versions

Stable Branch	Fixed Version
5.10	5.10.257
5.15	5.15.208
6.1	6.1.174
6.6	6.6.141
6.12	6.12.91
6.18	6.18.33
7.0	7.0.10
7.1+	Fixed

---

🛡 Mitigation

• Upgrade to a patched Linux kernel.
• Restrict local shell access for untrusted users.
• Apply the latest vendor security updates.
• Monitor systems for privilege-escalation attempts.
• Follow the principle of least privilege.

---

🔍 Detection

Indicators may include:

• Unexpected modification of read-only files
• Abnormal page-cache behavior
• Local privilege escalation attempts
• Kernel warnings related to networking memory management

---

📚 Technical Summary

Category	Description
CWE	Improper State Management
Vulnerability Type	Local Privilege Escalation
Exploitation	Local authenticated attacker
Requires Reboot	After kernel update
Remote Exploitable	❌ No

---

🧠 Key Takeaway

DirtyClone is not a network remote exploit—it is a local privilege escalation vulnerability caused by incorrect handling of shared socket-buffer fragments. Losing the SKBFL_SHARED_FRAG flag allows writes to memory that should remain protected, undermining Linux's Copy-on-Write guarantees and enabling privilege escalation under the right conditions.

---