Skip to content
OriginalConnect AISign inSign up free
Image: Security Affairs

Security AffairsPierluigi Paganini

DirtyClone flaw lets Linux users gain root via page cache exploit

Part of the CVE-2026-43503 story · since 27 Jun

Quiet for 20 weekslast report 29 Jun3 articles3 outlets
27 Jun · Security Affairs first6 Sep30 Sep24 OctNowThis article1st of 3
  • Sat 27 Jun, 10:30 UTC. Security Affairs, first report. DirtyClone flaw lets Linux users gain root via page cache exploit. This article, 1st of 3.
  • Sun 28 Jun, 15:28 UTC. SecurityOnline, its first report on the story. DirtyClone Flaw in Linux Kernel Enables Silent Root Escalation.
  • Mon 29 Jun, 11:40 UTC. SecurityWeek, its first report on the story. Linux Kernel Flaw 'DirtyClone' Lets Local Users Gain Root Access.

The article discusses a new Linux kernel vulnerability named DirtyClone (CVE-2026-43503), discovered by JFrog Security Research. This is the fourth vulnerability in the DirtyFrag family, allowing unprivileged local users to escalate privileges to root by manipulating the Linux page cache without leaving traces. The exploit, which has a CVSS score of 8.8, enables attackers to rewrite executables in memory indirectly, thus bypassing typical security measures.

It primarily affects distributions like Debian and Fedora, while Ubuntu 24.04 restricts the attack vector. Patching is advised, as previous exploits in this family remain unaddressed, indicating further risks. Workarounds include disabling unprivileged user namespaces and blacklisting certain kernel modules.

How the story developed

All 3 articles
Quiet for 20 weekslast report 29 Jun3 articles3 outlets

3 articles from 3 outlets since 27 Jun. Quiet since 29 Jun. This was the first report.

Now27 Jun2829301 Jul15 NovFirst reportSecurity Affairs · 27 Jun, 10:30
  • Sat 27 Jun, 10:30 UTC. Security Affairs, first report. DirtyClone flaw lets Linux users gain root via page cache exploit. This article, 1st of 3.
  • Sun 28 Jun, 15:28 UTC. SecurityOnline, its first report on the story. DirtyClone Flaw in Linux Kernel Enables Silent Root Escalation.
  • Mon 29 Jun, 11:40 UTC. SecurityWeek, its first report on the story. Linux Kernel Flaw 'DirtyClone' Lets Local Users Gain Root Access.
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 3 articles as a list
  1. Sat 27 JunDay 01
    1. DirtyClone flaw lets Linux users gain root via page cache exploit10:30 · Security Affairs · First report · This article, 1st of 3
  2. Sun 28 JunDay 11
    1. DirtyClone Flaw in Linux Kernel Enables Silent Root Escalation15:28 · SecurityOnline
  3. Mon 29 JunDay 21
    1. Linux Kernel Flaw 'DirtyClone' Lets Local Users Gain Root Access11:40 · SecurityWeek

Sources

CyberSIXTSignal over noise
Sign inSign up free

Updated