CVE-2026-43503

KO | EN

gitlite — search

#csharp #github #ui #rag #ios #git #ai-agent #tensorflow #proxy #command-line

(★ 34)

CVE-2026-43503

File Explorer

ZIP Download

CVE-2026-43503.c
README.md

# Use via CDN

jsDelivr

jsDelivr serves any public GitHub repository as a CDN with zero setup. Pick a version and a file to get a ready-to-paste link and snippet.

Version

File

Link

Example

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

### *When Shared Memory Stops Being Shared Safely.*

![Linux](https://img.shields.io/badge/Linux-Kernel-FCC624?style=for-the-badge&logo=linux&logoColor=black)
![Severity](https://img.shields.io/badge/Severity-High-red?style=for-the-badge)
![CVSS](https://img.shields.io/badge/CVSS-8.8-orange?style=for-the-badge)
![Type](https://img.shields.io/badge/Vulnerability-Local_Privilege_Escalation-darkred?style=for-the-badge)
![Status](https://img.shields.io/badge/Patch-Available-success?style=for-the-badge)

*A Local Privilege Escalation vulnerability caused by improper propagation of the*
`SKBFL_SHARED_FRAG` *flag inside the Linux networking stack.*

</div>

---

# 📖 Overview

**CVE-2026-43503**, nicknamed **DirtyClone**, is a **High Severity Local Privilege Escalation (LPE)** vulnerability affecting the Linux kernel networking subsystem.

The vulnerability exists because several Socket Buffer (SKB) fragment-copy routines fail to preserve the **`SKBFL_SHARED_FRAG`** flag when cloning or transferring packet fragments.

As a result, memory that should remain protected by **Copy-on-Write (CoW)** semantics may become writable unexpectedly, allowing a local attacker to modify read-only page-cache data under specific conditions.

---

# ⚡ Why "DirtyClone"?

The name **DirtyClone** reflects two key characteristics:

- **Dirty** → Shared page-cache memory becomes unexpectedly writable.
- **Clone** → Triggered during cloning or transferring SKB fragments.

Similar to previous Linux memory corruption vulnerabilities, the issue stems from incorrect handling of shared memory metadata rather than a traditional buffer overflow.

---

# 🎯 Impact

Successful exploitation may allow an attacker to:

- 🔺 Escalate privileges to **root**
- 🛠 Modify root-owned read-only files
- 💾 Corrupt page-cache backed memory
- ⚠ Bypass expected Copy-on-Write protections
- 🔥 Execute arbitrary code with elevated privileges (depending on exploit chain)

---

# 🧩 Root Cause

Several networking helper functions clone or move packet fragments without copying the:

```c
SKBFL_SHARED_FRAG
```

flag.

Consequently, the destination socket buffer incorrectly assumes ownership of memory that is actually shared.

This breaks the kernel's assumptions about page ownership and write protection.

---

# 🔬 Affected Functions

```
__pskb_copy_fclone()

skb_shift()

skb_gro_receive()

skb_gro_receive_list()

tcp_clone_payload()

skb_segment()
```

Each of these routines may propagate fragment references without preserving the shared-fragment state.

---

# 💥 Attack Flow

```text
Local User
     │
     ▼
Create crafted networking workload
     │
     ▼
SKB Fragment Cloning
     │
     ▼
SKBFL_SHARED_FRAG Lost
     │
     ▼
Shared Memory Appears Private
     │
     ▼
Write Into Read-Only Page Cache
     │
     ▼
Privilege Escalation
```

---

# 📸 Demo

---

# 📊 Vulnerability Details

| Property | Value |
|----------|-------|
| CVE | CVE-2026-43503 |
| Nickname | DirtyClone |
| Severity | High |
| CVSS v3.1 | 8.8 |
| Attack Vector | Local |
| Complexity | Low |
| Privileges Required | Low |
| User Interaction | None |
| Scope | Changed |
| Impact | Privilege Escalation |

---

# 🖥 Affected Component

```
Linux Kernel

Subsystem:
net/skbuff
```

---

# ✅ Fixed Kernel Versions

| Stable Branch | Fixed Version |
|---------------|--------------|
| 5.10 | 5.10.257 |
| 5.15 | 5.15.208 |
| 6.1 | 6.1.174 |
| 6.6 | 6.6.141 |
| 6.12 | 6.12.91 |
| 6.18 | 6.18.33 |
| 7.0 | 7.0.10 |
| 7.1+ | Fixed |

---

# 🛡 Mitigation

- Upgrade to a patched Linux kernel.
- Restrict local shell access for untrusted users.
- Apply the latest vendor security updates.
- Monitor systems for privilege-escalation attempts.
- Follow the principle of least privilege.

---

# 🔍 Detection

Indicators may include:

- Unexpected modification of read-only files
- Abnormal page-cache behavior
- Local privilege escalation attempts
- Kernel warnings related to networking memory management

---

# 📚 Technical Summary

| Category | Description |
|----------|-------------|
| CWE | Improper State Management |
| Vulnerability Type | Local Privilege Escalation |
| Exploitation | Local authenticated attacker |
| Requires Reboot | After kernel update |
| Remote Exploitable | ❌ No |

---

# 🧠 Key Takeaway

> **DirtyClone is not a network remote exploit—it is a local privilege escalation vulnerability caused by incorrect handling of shared socket-buffer fragments. Losing the `SKBFL_SHARED_FRAG` flag allows writes to memory that should remain protected, undermining Linux's Copy-on-Write guarantees and enabling privilege escalation under the right conditions.**

---

## ⭐ Stay Updated

Kernel privilege escalation vulnerabilities continue to demonstrate how subtle memory-management mistakes can have major security consequences.

If this repository was useful, consider ⭐ starring it to support cybersecurity research and vulnerability documentation.

</div>

CVE-2026-43503

Owner Repos

File Explorer

# Use via CDN

Was this content helpful?

Recent Feedback

CVE-2026-43503

Owner Repos

File Explorer

# Use via CDN

Was this content helpful?

Recent Feedback

Download README