DirtyDecrypt / DirtyCBC — Linux Kernel rxgk Root LPE with Public PoC (CVE-2026-31635)
DirtyDecrypt / DirtyCBC (TL-2026-0524), also tracked as DirtyDecrypt, is a high-severity software vulnerability scored CVSS 7.8, first published 2026-05-18 and last reviewed 2026-07-29. It has no confirmed attribution, affects Linux Kernel Linux Kernel (rxrpc/rxgk subsystem), references 1 CVE (CVE-2026-31635), maps to 25 MITRE ATT&CK techniques (T1003, T1055, T1059), and is covered by 9 detection rules and 28 indicators of compromise.
Key facts for TL-2026-0524
- Threat ID
- TL-2026-0524
- Also known as
- DirtyDecrypt, DirtyCBC
- Severity
- HIGH
- CVSS
- 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- Status
- MONITORING
- Category
- VULNERABILITY
- First published
- 2026-05-18
- Last reviewed
- 2026-07-29
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- technology, research, academia, government, financial, telecommunications, cloud-hosting
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 28
- Updates
- 2026-07-29 · revalidated 1× · latest source
Malware and tooling in DirtyDecrypt / DirtyCBC
Malware and tooling: dirtydecrypt-poc / poc.c (V12)
DirtyDecrypt (also tracked as DirtyCBC) is a Linux kernel local privilege escalation vulnerability in the rxrpc/rxgk subsystem (RxGK security support for the Andrew File System client), tracked as CVE-2026-31635 and patched upstream on 2026-04-25. The V12 security team released a public proof-of-concept (poc.c) on 2026-05-18, demonstrating root access on Linux distributions built with CONFIG_RXGK (Fedora, Arch, openSUSE Tumbleweed). The flaw is a missing/inverted length-check in rxgk_verify_response() that passes an oversized authenticator to rxgk_decrypt_skb(), reaching skb_to_sgvec() with an impossible length — V12 weaponized the resulting page-cache corruption ('CBC' / 'COW-style' write) into a deterministic root primitive in the same vulnerability class as Dirty Frag, Fragnesia, and Copy Fail (the latter currently in CISA KEV).
How DirtyDecrypt / DirtyCBC works
DirtyDecrypt / DirtyCBC is a memory-safety vulnerability in the Linux kernel's rxrpc/rxgk module — the RxGK Kerberos-style security layer used by the in-kernel Andrew File System (AFS) client. The upstream commit description (a2567217ade9 / beee051f259a / e2f1a80d8b1e) confirms the root cause: rxgk_verify_response() decodes auth_len from the network packet and was supposed to verify that the declared authenticator length fits within the remaining packet payload. The existing check was logically inverted, so oversized RESPONSE authenticators were accepted and passed to rxgk_decrypt_skb(), which then forwarded the impossible length to skb_to_sgvec() in net/core/skbuff.c, triggering BUG_ON(len) and, on V12's weaponized path, a controlled out-of-bounds write into adjacent skb fragment pages.
Will Dormann of Tharros (formerly CERT/CC) mapped the V12 PoC to CVE-2026-31635 after the V12 team reported the bug to upstream on 2026-05-09 and were informed their report was a duplicate of the mainline patch already shipped two weeks earlier. V12's poc.c reframes the kernel BUG as a deterministic LPE primitive by abusing the page-cache aliasing path inside the rxrpc receive workqueue (rxrpc_process_connection -> conn_event -> rxgk_verify_response -> rxgk_decrypt_skb). Because the affected skb data is decrypted in-place into pagecache-backed fragments that are also mapped read-only into user processes (the 'CBC decrypt to pagecache' anti-pattern that gives DirtyCBC its name), an unprivileged local attacker can race the kernel worker to overwrite a read-only file backing a SUID binary, yielding deterministic root on default-installed CONFIG_RXGK distros.
Exploitation prerequisites are minimal: an unprivileged local shell on a Linux system where the rxrpc/rxgk modules can be auto-loaded (default on Fedora 39+, Arch Linux, openSUSE Tumbleweed; not enabled in Ubuntu LTS or Debian stable defaults). The V12 PoC compiles to a single ELF binary, takes 6-12 seconds to land root on the published targets, and survives full ASLR/SMEP/SMAP/KPTI because the write primitive is data-only against pagecache. The fix landed on 2026-04-25 in mainline and was backported across stable trees the same day — distributions shipping kernels older than 2026-04-25 remain exploitable.
This vulnerability is the fourth in a clearly related family of Linux kernel net/decrypt page-cache write bugs that began with Dirty Frag (ipsec IPv6 fragment reassembly, 2025), Fragnesia (esp6 ESP-NULL decrypt path, 2025), and Copy Fail (CVE-2025-XXXXX, currently in CISA KEV after observed in-the-wild abuse against cloud Linux fleets). The reuse of the 'Dirty' / 'CBC' / 'Copy' naming reflects the shared root primitive — kernel-side in-place decrypt that aliases user-readable pagecache pages — and SOC/IR teams should treat DirtyDecrypt as a near-certain candidate for inclusion in CISA KEV within 4-8 weeks of public PoC.
Detection focuses on rxgk module load on hosts that have no legitimate AFS dependency, anomalous rxrpc workqueue stack traces, sudden writes to SUID binaries by non-root processes, and the V12 PoC's distinctive use of rxrpc_setsockopt(RXRPC_SECURITY_RXGK) followed by crafted RESPONSE packets to 127.0.0.1. Mitigation when patching is impossible: blacklist esp4/esp6/rxrpc modules via /etc/modprobe.d (breaks IPsec VPNs and AFS) and run `echo 3 > /proc/sys/vm/drop_caches` after any suspicious activity to evict potentially-poisoned pagecache pages.
MITRE ATT&CK techniques used in TL-2026-0524
Credential Access
T1003 OS Credential Dumping; T1556 Modify Authentication Process
Privilege Escalation
T1055 Process Injection; T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism; T1611 Escape to Host
Execution
T1059 Command and Scripting Interpreter; T1106 Native API; T1203 Exploitation for Client Execution
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Discovery
T1082 System Information Discovery; T1518 Software Discovery
Persistence
T1098 Account Manipulation; T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution; T1554 Compromise Host Software Binary
Lateral Movement
T1210 Exploitation of Remote Services
Defense Evasion
T1211 Exploitation for Stealth; T1574 Hijack Execution Flow
Impact
T1499 Endpoint Denial of Service
Resource Development
Reconnaissance
T1592 Gather Victim Host Information
defense-impairment
Affected products and versions in DirtyDecrypt / DirtyCBC
- Linux Kernel — Linux Kernel (rxrpc/rxgk subsystem)
Vulnerable versions: 6.10 through 6.14.4; all stable trees prior to the 2026-04-25 backport
Fixed in: 6.14.5; 6.13.x with backport commit a2567217ade9; 6.12.x stable with backport; 6.6.x LTS with backport - Fedora Project — Fedora
Vulnerable versions: Fedora 39; Fedora 40; Fedora 41
Fixed in: Fedora 41 with kernel >= 6.14.5-200.fc41 - Arch Linux — Arch Linux
Vulnerable versions: rolling release prior to 2026-04-26
Fixed in: rolling release with kernel >= 6.14.5.arch1-1 - openSUSE — openSUSE Tumbleweed
Vulnerable versions: snapshots prior to 2026-04-27
Fixed in: snapshots with kernel >= 6.14.5-1.1
Remediation for DirtyDecrypt / DirtyCBC
Patches
- Upstream Linux kernel commit a2567217ade970ecc458144b6be469bc015b23e5
- Upstream Linux kernel commit beee051f259acd286fed64c32c2b31e6f5097eb5
- Upstream Linux kernel commit e2f1a80d8b1ed6a5ae585a399c2b46500bdcc305
- Fedora kernel >= 6.14.5-200.fc41 (2026-04-26)
- Arch Linux kernel >= 6.14.5.arch1-1 (2026-04-26)
- openSUSE Tumbleweed kernel >= 6.14.5-1.1 (2026-04-27)
Immediate actions
- Apply the upstream kernel patch (commits a2567217ade9, beee051f259a, e2f1a80d8b1e) or the vendor-backported equivalent from your distribution's 2026-04-25 or later kernel release.
- Inventory hosts with CONFIG_RXGK enabled: `grep CONFIG_RXGK /boot/config-$(uname -r)` — prioritize Fedora 39+, Arch, openSUSE Tumbleweed.
- Where patching is delayed and AFS is not in use, blacklist the rxrpc module: `echo 'install rxrpc /bin/true' > /etc/modprobe.d/blacklist-rxrpc.conf` then `rmmod rxrpc` (also blacklist esp4/esp6 if Dirty Frag / Fragnesia / Copy Fail are not yet remediated).
Workarounds
- Blacklist rxrpc module via /etc/modprobe.d (breaks AFS).
- echo 3 > /proc/sys/vm/drop_caches after any suspicious local-user activity to evict potentially-poisoned pagecache pages.
- Disable CONFIG_RXGK in custom kernel builds (set =n in .config and rebuild).
- Restrict unprivileged user network namespace creation: sysctl kernel.unprivileged_userns_clone=0.
Longer-term hardening
- Deploy EDR with kernel-module-load auditing (auditd -w /sys/module -p wa or eBPF kmod hooks) and alert on rxrpc/rxgk loads outside change windows.
- Enable kernel.modules_disabled=1 after boot on hosts that do not legitimately load modules at runtime.
- Enable Lockdown LSM in 'confidentiality' mode where compatible.
- Adopt a SUID binary integrity monitor (AIDE, Tripwire, or osquery hash-of-suid pack) to detect post-exploit pagecache poisoning.
- Subscribe to CISA KEV updates — historical pattern (Dirty Frag, Fragnesia, Copy Fail) suggests KEV inclusion within 4-8 weeks of public PoC.
CVEs associated with DirtyDecrypt / DirtyCBC
Weaknesses (CWE) in DirtyDecrypt / DirtyCBC
CWE-787, CWE-125, CWE-1284, CWE-130
Timeline of DirtyDecrypt / DirtyCBC
- Linux kernel maintainers identify the inverted length check in rxgk_verify_response() during routine review of latest-net reproduction logs that flagged a BUG_ON(len) in __skb_to_sgvec().
- CVE-2026-31635 reserved and published in NVD (initial vulnStatus: Awaiting Analysis). NVD secondary CVSS: 7.5 HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, DoS framing).
- Upstream Linux kernel commits a2567217ade9, beee051f259a, e2f1a80d8b1e merged to mainline and immediately backported to stable trees 6.14.y, 6.13.y, 6.12.y, 6.6 LTS.
- Fedora ships kernel 6.14.5-200.fc41; Arch Linux ships 6.14.5.arch1-1. openSUSE Tumbleweed follows on 2026-04-27.
- NVD vulnStatus advances to 'Analyzed'; lastModified 2026-04-27T20:30:19.
- The Hacker News publishes initial coverage of the DirtyDecrypt PoC and CVE-2026-31635 LPE vulnerability.
- V12 security team independently reports the bug to linux-distros / security@kernel.org and is informed the issue is already patched as CVE-2026-31635.
- Will Dormann (Tharros) publicly maps the V12 finding to CVE-2026-31635 and assigns the names DirtyDecrypt / DirtyCBC, drawing a lineage to the Dirty Frag / Fragnesia / Copy Fail family.
- Threadlinqs Intelligence begins tracking as TL-2026-0524; AII-Researcher initiates full pipeline analysis (research -> simulate -> detect -> correlate -> publish).
- V12 security team releases public proof-of-concept exploit (poc.c) demonstrating local root on default-installed Fedora 41, Arch Linux, and openSUSE Tumbleweed. BleepingComputer publishes coverage.
- As of 2026-05-29, DirtyDecrypt (CVE-2026-31635) was patched upstream 2026-04-25 and across Fedora/Arch/openSUSE distros by 2026-04-27, but a reliable public PoC (V12/Zellic, 2026-05-18) still grants deterministic root on unpatched CONFIG_RXGK hosts. No confirmed in-the-wild exploitation and not yet in CISA KEV, though its Copy Fail lineage makes it a KEV candidate.
- NVD CVE-2026-31635 record last modified, confirming CWE-130 (Improper Handling of Length Parameter Inconsistency) classification and an AV:N network attack-vector framing — a narrower official framing than the local-LPE narrative already tracked.
- CVE-2026-31635 confirmed absent from the CISA Known Exploited Vulnerabilities catalog (version 2026.07.27); no active in-the-wild exploitation reported to date.
- Picus Security publishes a detailed technical writeup detailing the vmsplice()/splice()/skb_to_sgvec() page-cache-splice exploitation chain, naming Zellic (Aaron Esau, Luna Tong) as co-discoverers alongside V12.
Update history for TL-2026-0524
- 2026-07-29 — CVE-2026-31635 (DirtyDecrypt / DirtyCBC) - Linux Kernel AF_RXRPC Local Privilege Escalation: What changed No severity/exploitability/status escalation. NVD's official weakness classification is now confirmed as CWE-130 (previously tracked only under CWE-787/125/1284), and NVD's own CVSS framing treats this as a network-reachable (A
Sources cited for DirtyDecrypt / DirtyCBC
- Exploit available for new DirtyDecrypt Linux root escalation flaw
- NVD entry for CVE-2026-31635
- Linux kernel upstream patch — rxrpc: fix oversized RESPONSE authenticator length check
- Linux kernel stable backport commit beee051f259a
- Linux kernel stable backport commit e2f1a80d8b1e
- Will Dormann / Tharros — CVE mapping disclosure thread
- V12 security team PoC release (poc.c)
- CISA Known Exploited Vulnerabilities Catalog (background — Copy Fail family)
Threats related to DirtyDecrypt / DirtyCBC
- RefluXFS: Linux Kernel XFS Copy-on-Write Race Condition Local Privilege Escalation (CVE-2026-64600)
- OVSWrap (CVE-2026-64531): Linux kernel Open vSwitch datapath 16-bit nla_len wraparound local privilege escalation with public PoC targeting ~800 x86-64 kernel builds
- CVE-2026-31431 "Copy Fail" — Linux Kernel algif_aead Deterministic Local Privilege Escalation Affecting All Major Distributions
- Linux Kernel act_pedit COW Out-of-Bounds Write Enables Local Privilege Escalation to Root (CVE-2026-46331)
- PinTheft — Linux Kernel RDS Zerocopy FOLL_PIN Refcount Imbalance Chained With io_uring Fixed Buffers For Page-Cache Overwrite And Local Root (Public PoC, Arch Linux Default-Affected)
- DirtyClone Linux Kernel Local Privilege Escalation via __pskb_copy_fclone() (CVE-2026-43503)
Detection coverage for TL-2026-0524
As of 2026-07-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0524 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.