{"id":975,"date":"2026-05-19T15:04:09","date_gmt":"2026-05-19T15:04:09","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=975"},"modified":"2026-05-19T15:04:09","modified_gmt":"2026-05-19T15:04:09","slug":"dirtydecrypt-poc-released-for-linux-kernel-cve-2026-31635-lpe-vulnerability","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=975","title":{"rendered":"DirtyDecrypt PoC Released for Linux Kernel CVE-2026-31635 LPE Vulnerability"},"content":{"rendered":"
\n
<\/a><\/div>\n

Proof-of-concept (PoC) exploit code has now been released for a recently patched security flaw in the Linux kernel that could allow for local privilege escalation (LPE).<\/p>\n

Dubbed DirtyDecrypt<\/strong> (aka DirtyCBC), the vulnerability was discovered and reported by the Zellic and V12 security team on May 9, 2026, only to be informed by the maintainers that it was a duplicate of a vulnerability that had already been patched in the mainline.<\/p>\n

\u00abIt’s a rxgk pagecache write due to missing COW<\/a> [copy-on-write] guard in rxgk_decrypt_skb,\u00bb Zellic co-founder Luna Tong (aka cts and gf_256) said<\/a> in a description shared on GitHub.<\/p>\n

Although the CVE identifier was not disclosed, the vulnerability in question is CVE-2026-31635<\/a> (CVSS score: 7.5) based on the fact that the NIST National Vulnerability Database (NVD) includes a link to the DirtyDecrypt PoC in its CVE record.<\/p>\n

\u00abThe specific fault sits in rxgk_decrypt_skb(), the function that decrypts an incoming sk_buff (socket buffer) on the receive side,\u00bb Moselwal said<\/a>.<\/p>\n

\u00abIn this code path the kernel handles memory pages that are partly shared with the page cache of other processes \u2013 a normal Linux optimisation protected by copy-on-write: as soon as a write to a shared page happens, a private copy is made beforehand so that the write doesn’t bleed into another process’s data.\u00bb<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The absence of this COW guard in rxgk_decrypt_skb means that data gets written to the memory of privileged processes or, depending on the exploit path, to the page cache of privileged files, such as etc\/shadow, \/etc\/sudoers, or a SUID binary, leading to local privilege escalation.<\/p>\n

DirtyDecrypt impacts only distributions with CONFIG_RXGK<\/a> enabled, such as Fedora, Arch Linux, and openSUSE Tumbleweed. In containerized environments, worker nodes running a vulnerable version of Linux could provide a pathway to escape the pod.<\/p>\n

The vulnerability, per Zellic, is assessed to be a variant of Copy Fail (CVE-2026-31431), Dirty Frag aka Copy Fail 2 (CVE-2026-43284 and CVE-2026-43500), and Fragnesia (CVE-2026-46300), all of which grant root access on vulnerable systems.<\/p>\n

<\/p>\n

Copy Fail<\/a>, a local privilege escalation flaw in the AF_ALG cryptographic socket interface, was disclosed by researchers at Theori on April 29, 2026. It was followed by Dirty Frag<\/a> a week later. Dirty Frag expands on Copy Fail with two page-cache write primitives.<\/p>\n

However, security researcher Hyunwoo Kim was forced to go ahead with public disclosure after the agreed-upon embargo window ended prematurely when a merged patch for CVE-2026-43284 on May 5 led another researcher, who was unaware of the embargo, to analyze and independently publish details<\/a> of the defect.<\/p>\n

\u00abI read the commit, recognized the xfrm ESP-in-UDP\u00a0 MSG_SPLICE_PAGES no-COW path against shared pipe pages as an LPE\u00a0 primitive, and built a PoC,\u00bb the researcher, who goes by the online aliases 0xdeadbeefnetwork and afflicted.sh, noted<\/a>. \u00abThe work is n-day weaponization from a public upstream commit, which is\u00a0 standard practice once a security-relevant fix lands in a public tree.\u00bb<\/p>\n

Fragnesia is another variant of Dirty Frag and impacts the XFRM ESP-in-TCP subsystem. But the outcome is the same: it allows unprivileged local attackers to modify read-only file contents in the kernel page cache and obtain root privileges.<\/p>\n

The development dovetails with the discovery of an LPE flaw in the Linux PackageKit<\/a> daemon (CVE-2026-41651<\/a>aka Pack2TheRoot, CVSS score: 8.8) and an improper privilege management flaw in the kernel (CVE-2026-46333<\/a>akassh-keysign-pwn<\/a>, CVSS score: 5.5), which allows an unprivileged local user to read root-owned secrets like SSH private keys.<\/p>\n

Various Linux distributions have released advisories for CVE-2026-46333 –<\/p>\n

Kernel Killswitch?<\/h3>\n

The flurry of new disclosures within a span of a few weeks has prompted Linux kernel developers to review a proposal for an emergency \u00abkillswitch\u00bb that would allow administrators to disable vulnerable kernel functions at runtime until a patch for a zero-day vulnerability becomes available.<\/p>\n

\u00abKillswitch lets a privileged operator make a chosen kernel function return a fixed value without executing its body, as a temporary mitigation for a security bug while a real fix is being prepared,\u00bb according to a proposal<\/a> submitted by Linux kernel developer and maintainer Sasha Levin.<\/p>\n

\u00abThe function returns the operator-supplied value and nothing else runs in its place. There is no allowlist, no return-type check; if the kprobe layer accepts the symbol, killswitch engages it. Once engaged, the change is in effect on every CPU until \u00abdisengage\u00ab is written or the system reboots.\u00bb<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Rocky Linux Debuts Security Repository<\/h3>\n

Rocky Linux, for its part, has introduced an optional security repository<\/a> that allows the distribution to ship urgent security fixes quickly, particularly in scenarios where severe vulnerabilities become public knowledge before coordinated upstream fixes arrive.<\/p>\n

\u00abThe repository is disabled by default. That’s intentional,\u00bb the maintainers said<\/a>. \u00abThe default Rocky Linux experience stays exactly what it has always been: predictable, stable, and fully upstream-compatible. Administrators who want access to accelerated fixes can opt in when they need it.\u00bb<\/p>\n

The security repository specifically caters to \u00abspecific, narrow\u00bb cases where a significant vulnerability is public, exploit code exists, and upstream patches are not available yet. Rocky Linux has emphasized that it’s not a replacement for the regular release process.<\/p>\n

\u00abIf we push a fix and upstream decides not to address it, the next upstream kernel release will supersede our patched version,\u00bb the maintainers added. \u00abUsers who haven’t version-locked their kernel will, at that point, no longer have our fix. That’s the trade-off we accepted when building this.\u00bb<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Proof-of-concept (PoC) exploit code has now been released for a recently patched security flaw in the Linux kernel that could allow for local privilege escalation (LPE). Dubbed DirtyDecrypt (aka DirtyCBC),…<\/p>\n","protected":false},"author":1,"featured_media":976,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[1731,1729,1571,181,1574,1730,1024,68],"class_list":["post-975","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-cve202631635","tag-dirtydecrypt","tag-kernel","tag-linux","tag-lpe","tag-poc","tag-released","tag-vulnerability"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/975","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=975"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/975\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/976"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=975"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=975"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=975"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}