CVE-2026-43503

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 7.1-rc1 through 7.1-rc4

Description A local privilege escalation issue exists in the networking stack (skbuff) due to the improper propagation of the SKBFL SHARED FRAG flag during fragment transfers. Several functions and helpers, including pskb copy fclone(), skb shift(), skb gro receive(), skb gro receive list(), tcp clone payload(), skb segment(), and skb try coalesce(), fail to carry over this marker when moving fragment descriptors. This creates a mismatch where a socket buffer (skb) references externally-owned or page-cache-backed pages while skb has shared frag() incorrectly reports the status as false.

This flaw is exploitable by in-place writers, such as the Encapsulating Security Payload (ESP) input (esp4.c, esp6.c), which rely on skb has shared frag() to determine if data must be processed through skb cow data(). An unprivileged user can leverage this to write into the page cache of a root-owned read-only file via stray writes. This issue, dubbed DirtyClone, allows an application to escalate privileges to root levels and is particularly risky in multi-tenant cloud environments and Kubernetes clusters where unprivileged user namespaces are enabled.

Recommendations For Linux Kernel versions 7.1-rc1 through 7.1-rc4, apply the upstream fix (commit 48f6a5356a33) immediately. Restrict the use of unprivileged user namespaces to minimize the risk of exploitation.