CVE-2026-43503 DirtyClone: Unprivileged User+Net Namespace Creation

Ibrahim Saud@tektrix

•updated Jun 26, 2026•1•0•5

Detects unprivileged processes creating a new user namespace (CLONE_NEWUSER) followed by a network namespace (CLONE_NEWNET) and modifying procfs mapping files (uid_map, gid_map). This sequence is characteristic of the exploitation staging phase for CVE-2026-43503 (DirtyClone) to gain CAP_NET_ADMIN privileges and overwrite the page cache.