Another Vulunerability DirtyClone which was caused by DirtyFrag fixes not being comprehensive

Lounge Linux lounge
1

The CVE for Dirty Clone is CVE-2026-43503. And it is high severity with a score of 8.8.

This is a Local Privilege Escalation (LPE) vulnerability.

The JFrog security team recently identified that the fix for Dirty-Frag was not complete

Mitigation
If patching is not possible, do the following

  1. Block CAP_NET_ADMIN acquisition by setting kernel.unprivileged_userns_clone=0.
    Please note that setting kernel.unprivileged_userns_clone=0 will disable user namespaces. This has impact on systemd-services and on containers like dockers/VMs/etc. Also applications like firefox or firefox derived browsers, Thunderbird email client, which use usernamespaces will be impacted. Not sure whether other non-firefox based browsers will also be impacted or not.
  2. Blacklisting esp4, esp6, and rxrpc kernel modules.
    To blacklist the modules put the following in a text file with extension .conf and place it in the directory /etc/modprobe.d/
install esp4 /bin/false
install esp6 /bin/false
install rxrpc /bin/false

blacklist esp4
blacklist esp6
blacklist rxrpc

Doing this step will impact VPNs which depend on IPSec based on IPv4 and IPv6.
More details for these mitigation steps is over here.

2

This has been fixed in the following versions of Linux Kernel

fixed in 5.10.257 with commit fbeab9555564a1b98e8582cd106dfe46c4606991
fixed in 5.15.208 with commit 179f1852bdedc300e373e807cc102cd81feff196
fixed in 6.1.174 with commit 12401fcfb01f53ccc63ab0a3246570fe8f3105ee
fixed in 6.6.141 with commit 989214c66884d70716d83dc1d0bf5e16287bf349
fixed in 6.12.91 with commit fc6eb39c55e97df2f94ad974b8a5bbcd019da2c8
fixed in 6.18.33 with commit ff375cc75f9167168db38e0464a482d5fbc8d81d
fixed in 7.0.10 with commit 9bc9d6d6967a2239aa57af2aa53554eddd640d20
fixed in 7.1 with commit 48f6a5356a33dd78e7144ae1faef95ffc990aae0

Please note that these versions are for those released by the Linux Foundation Kernel. Each distro may not incorporate all the fixes and features based on these versions