mooder1/dirtyclone-cve-2026-43503Linux kernel local privilege escalation PoC for CVE-2026-43503 (DirtyClone). Exploits a cloned sk_buff flag loss to write into page-cache memory, injecting a root account without modifying disk.
Linux local privilege escalation. A cloned sk_buff loses the
SKBFL_SHARED_FRAG flag, so ESP in-place decryption writes into file-backed
page-cache memory. The PoC patches /etc/passwd in cache to inject a uid-0
account and gives a root shell. Disk is never modified.
Fixed in mainline 48f6a5356a33 (v7.1-rc5).
Run as an unprivileged user:
python3 CVE-2026-43503.py
[*] uid=1000 -> root
[+] injected uid 0 account 'firefart' (password: pwned)
uid=0(root) gid=0(root) groups=0(root)
[+] root achieved
Unpatched kernel, unprivileged user namespaces enabled, and python3 +
libcrypto + iproute2 + iptables on the target.
For authorized testing and research only.