New in the K8s_container-escape-audit CVE database: two Linux kernel local privilege escalations, both of…
Liam R. — Freelance Penetration Tester
New in the K8s_container-escape-audit CVE database: two Linux kernel local privilege escalations, both of the page-cache-poisoning class that's dominated kernel LPE disclosures this quarter.
CVE-2026-43503 — "DirtyClone" (CVSS 8.8)
The fourth member of the DirtyFrag family. The root cause is a contract failure in core skbuff: pskb_copy_fclone() and skb_shift() move frag descriptors without propagating the SKBFL_SHARED_FRAG marker. A downstream in-place writer (ESP/IPsec decryption) then sees skb_has_shared_frag() as false and writes over page-cache-backed pages it should have copied, landing attacker bytes in the cached image of a setuid-root binary. JFrog released a working exploit walkthrough on June 25.
CVE-2026-46331 — "pedit COW" (CVSS 8.5)
tcf_pedit_act() computes its copy-on-write range once before the key loop, missing the runtime header offset that typed keys add at execution time. The result is a partial COW: writes escape the privatised region into shared page-cache memory. Reachable through namespace-local CAP_NET_ADMIN; the public packet_edit_meme PoC overwrites /bin/su's ELF entry point.
If you maintain detection for this family, note that CVE-2026-43503 and CVE-2026-46300 (Fragnesia) are the same upstream remediation split across two CVE IDs, the CNA assigned 43503 to the second of the two Fragnesia commits (48f6a5356a33). Both are carried in the same vendor advisories; treat them as a single patch decision.
Detection caveat for IR teams: because these corrupt the page cache and not the disk, file-integrity baselines pass clean on a compromised host. Prioritise the kernel patch + reboot over detection-only controls. Interim mitigations, esp4/esp6/rxrpc or act_pedit module blacklists, and disabling unprivileged user namespaces, reduce the attack surface but are not fixes.
Fixed versions in the database were confirmed against the Debian security tracker and Ubuntu, per release. The tool is read-only, runs inside the container, and is free for non-commercial use.
#LinuxSecurity #KubernetesSecurity #ContainerSecurity #KernelSecurity #PrivilegeEscalation #DevSecOps #IncidentResponse #CVE
5 reactions · 0 comments
Topics: #devsecops, #cve, #containersecurity, #incidentresponse, #kubernetessecurity, #privilegeescalation, #kernelsecurity, #linuxsecurity