DirtyClone (CVE-2026-43503) - Python PoC

Non-official Python port of DirtyClone — a Linux kernel local privilege escalation vulnerability.

This repository contains a working Proof of Concept that allows an unprivileged local user to gain root privileges by exploiting page-cache corruption via cloned socket buffers.

About DirtyClone

DirtyClone (CVE-2026-43503) is the fourth member of the Dirty family* (DirtyPipe → DirtyFrag → DirtyClone).

It abuses improper flag propagation in __pskb_copy_fclone() when using the TEE netfilter target with ESP-in-UDP. This allows an attacker to perform in-place decryption directly into file-backed page cache memory, even after previous DirtyFrag mitigations.

• CVSS: 8.8 (High)
• Affected Kernels: Roughly Linux 7.1-rc1 to rc4 (before commit 48f6a5356a33)
• Requirements: Unprivileged user namespaces enabled (user.max_user_namespaces > 0)

Credits: Original research and technique by JFrog Security Research. This is an independent Python reimplementation.

Features

• Pure Python implementation (no compilation needed)
• Overwrites /etc/passwd to add a new uid=0 user
• Spawns an interactive root shell
• Clean & well-commented code
• Works on most vulnerable distributions

Demo

Disclaimer This tool is for educational and security research purposes only. Unauthorized use on systems you do not own is illegal. Use responsibly.

References

JFrog Security Research - DirtyClone Writeup (link when available) CVE-2026-43503 Linux kernel fix: 48f6a5356a33

Usage

# 1. Clone the repo
git clone https://github.com/entra1337/DirtyClone.git
cd DirtyClone

# 2. Run the exploit
python3 dirtyclone.py