New DirtyClone Linux Vulnerability Allows Attackers to Gain Root Access Via Cloned Packets

DirtyClone (CVE-2026-43503) is a high-severity Linux kernel local privilege-escalation vulnerability discovered by JFrog Security Research that allows unprivileged users to gain root by exploiting an skb packet-cloning path in the XFRM/IPsec subsystem which drops the SKBFL_SHARED_FRAG safety flag; it affects distributions with unprivileged user namespaces enabled, carries a CVSS score of 8.8, leaves no disk or kernel audit traces, and has been fixed in mainline with recommendations to update kernels, restrict user namespaces, blacklist unused IPsec modules, and drop page cache.