DirtyClone CVE-2026-43503 Linux Kernel LPE Exploit Execution Detection

Ibrahim Saud@tektrix

•updated Jun 26, 2026•1•0•8

Detects execution and compilation activities associated with the DirtyPipe (CVE-2022-0847) vulnerability, which allows an unprivileged user to overwrite data in read-only files, leading to privilege escalation to root. The rule tracks common exploit filenames, compilation patterns, and specific commands used for privilege escalation via unshare or su.