On June 25, 2026, JFrog published their research into CVE-2026-43503, referring to the vulnerability as DirtyClone. The vulnerability had previously been responsibly disclosed to the Linux kernel maintainers and the CVE record published on May 23, 2026. The vulnerability affects multiple Linux distributions, including all Ubuntu releases. The first security updates for Ubuntu were released on June 2, 2026.The vulnerability has a CVSS 3.1 score of 8.8, corresponding to HIGH severity, as published on May 30, 2026.This vulnerability affects the same components as the Dirty Frag and Fragnesia vulnerabilities. As such, if you have applied the mitigations for any of these vulnerabilities by blocking the affected kernel modules, you are also protected against the DirtyClone vulnerability.ImpactDeployments without container workloadsOn hosts that do not run container workloads, the vulnerability allows a local user to elevate privileges to the root user. The published exploit executes in this type of deployment.Container deploymentsIn container deployments that may execute arbitrary third-party workloads, the vulnerability may additionally facilitate container escape scenarios, in addition to local privilege escalation on the host. A proof-of-concept exploit has not been published yet for container escape.Affected releasesThe vulnerability fix is distributed through the Linux kernel image packages.Please note that if you have previously applied the mitigations described for Dirty Frag or Fragnesia, your system is not affected by DirtyClone.ReleasePackage NameRemediation StatusTrusty Tahr (14.04 LTS)linuxAffectedXenial Xerus (16.04 LTS)linuxAffectedBionic Beaver (18.04 LTS)linuxAffectedFocal Fossa (20.04 LTS)linuxLinux 5.4: AffectedLinux 5.15: Fixed in 5.15.0-181.191~20.04.1Jammy Jellyfish (22.04 LTS)linuxFixed in 5.15.0-181.191Noble Numbat (24.04 LTS)linuxFixed in 6.8.0-124.124Questing Quokka (25.10)linuxFixed in 6.17.0-35.35Resolute Raccoon (26.04 LTS)linuxFixed in 7.0.0-22.22How to check if you are impactedOn your system, run the following command to get the version of the currently running kernel and compare the listed version to the corresponding table above.uname -rThe list of installed kernel packages can be obtained using the following command:dpkg -l 'linux-image*' | grep ^iiSecurity updatesWe recommend you upgrade all packages:sudo apt update && sudo apt upgradeIf this is not possible and the Linux kernel is installed via a meta package, its update can be targeted directly:sudo apt updatedpkg-query -W -f '${source:Package}\t${binary:Package}\n' | awk '$1 ~ "^linux-meta" { print $2 }' | xargs sudo apt install --only-upgradeA reboot is required once the security updates for the Linux kernel are installed. sudo rebootThe unattended-upgrades feature is enabled by default for Ubuntu 16.04 LTS onwards. This service: Applies new security updates every 24 hours automatically.If you have this enabled, the patches above will be automatically applied within 24 hours of being available, but a reboot is still required.