Linux Kernel DirtyClone Vulnerability Lets Local Attackers Gain Root Privileges

JFrog Security Research disclosed 'DirtyClone' (CVE-2026-43503), a Linux kernel local privilege escalation in the XFRM/IPsec via netfilter TEE path that allows attackers with CAP_NET_ADMIN (often obtainable via unprivileged user namespaces) to trick the kernel into writing decrypted data into file-backed page-cache memory and achieve silent root access; the advisory includes technical details, related DirtyFrag variants, a CVSS 8.8 rating, disclosure/patch timeline, and mitigation recommendations (update kernels or disable unprivileged user namespaces).