DirtyClone CVE-2026-43503 Unprivileged IPsec Tunnel Setup for Page-Cache Corruption

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•2

This rule detects potentially malicious command-line arguments used with common Linux utilities. It monitors for: the use of 'unshare' for namespace manipulation often used for privilege escalation or container escapes, the 'ip xfrm' command for configuring IPsec policies, and the loading of kernel modules ('modprobe'/'insmod') with suspicious parameters ('esp4', 'esp6', 'rxrpc') which could indicate the installation of malicious rootkits or kernel-level backdoors.