CVE-2026-43503 DirtyClone: Unprivileged XFRM IPsec SA creation correlated with user namespace setup

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•6

Detects a suspicious sequence of events on Linux where a non-root process creates a user namespace followed within 5 minutes by either network XFRM policy manipulation or the loading of specific kernel modules (esp4, esp6, or rxrpc). This behavior is characteristic of an attempt to bypass kernel security restrictions or establish unauthorized encrypted tunnels.