--- title: DirtyClone Linux kernel local privilege escalation vulnerability fixes available description: Fixes are available in Ubuntu for the DirtyClone Linux kernel local privilege escalation vulnerability. url: https://canonical.com/blog/dirtyclone-linux-vulnerability-fixes-available?format=md --- 1. [Blog](https://canonical.com/blog) 2. Article --- [Luci Stanescu](https://canonical.com/blog/author/lucistanescu "More about Luci Stanescu") 1 July 2026 # DirtyClone Linux kernel local privilege escalation vulnerability fixes available [Security](https://canonical.com/blog/tag/security) [Vulnerabilities](https://canonical.com/blog/tag/vulnerabilities) --- Share the article On June 25, 2026, JFrog published their [research](https://research.jfrog.com/post/dissecting-and-exploiting-linux-lpe-variant-dirtyclone-cve-2026-43503) into [CVE-2026-43503](https://ubuntu.com/security/CVE-2026-43503), referring to the vulnerability as DirtyClone. The vulnerability had previously been responsibly disclosed to the Linux kernel maintainers and the CVE record published on May 23, 2026. The vulnerability affects multiple Linux distributions, including all Ubuntu releases. The first security updates for Ubuntu were released on June 2, 2026. The vulnerability has a CVSS 3.1 score of 8.8, corresponding to HIGH severity, as published on May 30, 2026. This vulnerability affects the same components as the [Dirty Frag](https://ubuntu.com/blog/dirty-frag-linux-vulnerability-fixes-available) and [Fragnesia](https://ubuntu.com/blog/fragnesia-linux-vulnerability-fixes-available) vulnerabilities. As such, if you have applied the mitigations for any of these vulnerabilities by blocking the affected kernel modules, you are also protected against the DirtyClone vulnerability. ## Impact ### Deployments without container workloads On hosts that do not run container workloads, the vulnerability allows a local user to elevate privileges to the root user. The published exploit executes in this type of deployment. ### Container deployments In container deployments that may execute arbitrary third-party workloads, the vulnerability may additionally facilitate container escape scenarios, in addition to local privilege escalation on the host. A proof-of-concept exploit has not been published yet for container escape. ## Affected releases The vulnerability fix is distributed through the Linux kernel image packages. Please note that if you have previously applied the mitigations described for [Dirty Frag](https://ubuntu.com/blog/dirty-frag-linux-vulnerability-fixes-available) or [Fragnesia](https://ubuntu.com/blog/fragnesia-linux-vulnerability-fixes-available), your system is not affected by DirtyClone. | **Release** | **Package Name** | **Remediation Status** | | --- | --- | --- | | Trusty Tahr (14.04 LTS) | linux | Affected | | Xenial Xerus (16.04 LTS) | linux | Affected | | Bionic Beaver (18.04 LTS) | linux | Affected | | Focal Fossa (20.04 LTS) | linux | Linux 5.4: Affected Linux 5.15: Fixed in 5.15.0-181.191~20.04.1 | | Jammy Jellyfish (22.04 LTS) | linux | Fixed in 5.15.0-181.191 | | Noble Numbat (24.04 LTS) | linux | Fixed in 6.8.0-124.124 | | Questing Quokka (25.10) | linux | Fixed in 6.17.0-35.35 | | Resolute Raccoon (26.04 LTS) | linux | Fixed in 7.0.0-22.22 | ## How to check if you are impacted On your system, run the following command to get the version of the currently running kernel and compare the listed version to the corresponding table above. ``` uname -r ``` The list of installed kernel packages can be obtained using the following command: ``` dpkg -l 'linux-image*' | grep ^ii ``` ## Security updates We recommend you upgrade all packages: ``` sudo apt update && sudo apt upgrade ``` If this is not possible and the Linux kernel is installed via a meta package, its update can be targeted directly: ``` sudo apt update dpkg-query -W -f '${source:Package}\t${binary:Package}\n' | awk '$1 ~ "^linux-meta" { print $2 }' | xargs sudo apt install --only-upgrade ``` A reboot is required once the security updates for the Linux kernel are installed. ``` sudo reboot ``` The unattended-upgrades feature is enabled by default for Ubuntu 16.04 LTS onwards. This service: * Applies new security updates every 24 hours automatically. * If you have this enabled, the patches above will be automatically applied within 24 hours of being available, but a reboot is still required. [Get in touch Interested in running Ubuntu in your organization?](https://ubuntu.com/about/contact-us/form) ## Sign up for our newsletter Get the latest Canonical news and updates in your inbox. Work email: \*I agree to receive information about Canonical's products and services. By submitting this form, I confirm that I have read and agree to [Canonical's Privacy Policy](https://canonical.com/legal/dataprivacy). Sign up ## Share on --- ## Related posts [### Januscape vulnerability CVE-2026-53359 mitigations available](https://canonical.com/blog/januscape-linux-vulnerability-mitigations-available) Introduction A local privilege escalation (LPE) vulnerability affecting the Linux kernel was publicly disclosed on July 6, 2026. The vulnerability was assigned CVE ID... [seth-arnold](https://canonical.com/blog/author/seth-arnold) 11 July 2026 [### pedit COW kernel local privilege escalation vulnerability mitigations](https://canonical.com/blog/pedit-cow-linux-vulnerability-fixes-available) Mitigations are available for the Linux vulnerability with CVE ID CVE-2026-46331. The CVE ID was assigned on June 16 2026 and highlighted as a local privilege escalation (LPE)... [Luci Stanescu](https://canonical.com/blog/author/lucistanescu) 1 July 2026 [### PinTheft Linux kernel vulnerability mitigation](https://canonical.com/blog/pintheft-linux-kernel-vulnerability-mitigation) A local privilege escalation (LPE) security vulnerability in the Linux kernel, codename “PinTheft,” was publicly disclosed on May 19, 2026. The vulnerability was fixed in the... [seth-arnold](https://canonical.com/blog/author/seth-arnold) 21 May 2026 [### CVE-2026-46333 (ssh-keysign-pwn) Linux kernel vulnerability mitigations](https://canonical.com/blog/ssh-keysign-pwn-linux-vulnerability-fixes-available) An information disclosure security vulnerability in the Linux kernel was publicly disclosed on May 15th, 2026. The vulnerability was reported by Qualys and fixed in the... [Luci Stanescu](https://canonical.com/blog/author/lucistanescu) 19 May 2026