🚨 CVE-2026-43503 — DirtyClone

When Shared Memory Stops Being Shared Safely.

A Local Privilege Escalation vulnerability caused by improper propagation of the SKBFL_SHARED_FRAG flag inside the Linux networking stack.

📖 Overview

CVE-2026-43503, nicknamed DirtyClone, is a High Severity Local Privilege Escalation (LPE) vulnerability affecting the Linux kernel networking subsystem.

The vulnerability exists because several Socket Buffer (SKB) fragment-copy routines fail to preserve the SKBFL_SHARED_FRAG flag when cloning or transferring packet fragments.

As a result, memory that should remain protected by Copy-on-Write (CoW) semantics may become writable unexpectedly, allowing a local attacker to modify read-only page-cache data under specific conditions.

⚡ Why "DirtyClone"?

The name DirtyClone reflects two key characteristics:

• Dirty → Shared page-cache memory becomes unexpectedly writable.
• Clone → Triggered during cloning or transferring SKB fragments.

Similar to previous Linux memory corruption vulnerabilities, the issue stems from incorrect handling of shared memory metadata rather than a traditional buffer overflow.

🎯 Impact

Successful exploitation may allow an attacker to:

• 🔺 Escalate privileges to root
• 🛠 Modify root-owned read-only files
• 💾 Corrupt page-cache backed memory
• ⚠ Bypass expected Copy-on-Write protections
• 🔥 Execute arbitrary code with elevated privileges (depending on exploit chain)

🧩 Root Cause

Several networking helper functions clone or move packet fragments without copying the:

SKBFL_SHARED_FRAG

flag.

Consequently, the destination socket buffer incorrectly assumes ownership of memory that is actually shared.

This breaks the kernel's assumptions about page ownership and write protection.

🔬 Affected Functions

__pskb_copy_fclone()

skb_shift()

skb_gro_receive()

skb_gro_receive_list()

tcp_clone_payload()

skb_segment()

Each of these routines may propagate fragment references without preserving the shared-fragment state.

💥 Attack Flow

Local User
     │
     ▼
Create crafted networking workload
     │
     ▼
SKB Fragment Cloning
     │
     ▼
SKBFL_SHARED_FRAG Lost
     │
     ▼
Shared Memory Appears Private
     │
     ▼
Write Into Read-Only Page Cache
     │
     ▼
Privilege Escalation

📸 Demo

📊 Vulnerability Details

🖥 Affected Component

Linux Kernel

Subsystem:
net/skbuff

✅ Fixed Kernel Versions

🛡 Mitigation

• Upgrade to a patched Linux kernel.
• Restrict local shell access for untrusted users.
• Apply the latest vendor security updates.
• Monitor systems for privilege-escalation attempts.
• Follow the principle of least privilege.

🔍 Detection

Indicators may include:

• Unexpected modification of read-only files
• Abnormal page-cache behavior
• Local privilege escalation attempts
• Kernel warnings related to networking memory management

📚 Technical Summary

🧠 Key Takeaway

DirtyClone is not a network remote exploit—it is a local privilege escalation vulnerability caused by incorrect handling of shared socket-buffer fragments. Losing the SKBFL_SHARED_FRAG flag allows writes to memory that should remain protected, undermining Linux's Copy-on-Write guarantees and enabling privilege escalation under the right conditions.