Linux kernel and SiteGuard WAF face critical vulnerabilities

Multiple critical vulnerabilities have been identified in widely used software. A Linux kernel vulnerability, known as ‘DirtyClone’ (CVE-2026-43503), allows attackers to overwrite page cache data through flaws in network socket processing. This flaw enables an attacker who has gained initial access to a system to escalate privileges to root by overwriting data in page regions where SUID files are cached. Exploit code for this vulnerability has already been made public.

Separately, EG Secure Solutions has issued an emergency alert regarding an OS command injection vulnerability (CVE-2026-106931) in its host-based WAF, ‘SiteGuard Server Edition’. The vulnerability exists when the default statistics function is enabled, potentially allowing the execution of arbitrary OS commands with root or SYSTEM privileges. Exploitation of this flaw has already been confirmed. Users are urged to update to the latest versions or apply provided patches to mitigate the risk.