CVE-2026-43503 DirtyClone: Unprivileged User Namespace Creation for CAP_NET_ADMIN

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•3

This rule detects suspicious manipulation of Linux namespaces using the 'unshare' utility or manual modification of user ID mapping files ('uid_map', 'gid_map', 'setgroups') in '/proc/self/'. Such activities are characteristic of container escape attempts or privilege escalation, where an attacker seeks to gain root access on the host or map unprivileged users to privileged IDs within a new namespace.