# DirtyDecrypt / DirtyCBC — Linux Kernel rxgk Root LPE with Public PoC (CVE-2026-31635)

> DirtyDecrypt (also tracked as DirtyCBC) is a Linux kernel local privilege escalation vulnerability in the rxrpc/rxgk subsystem (RxGK security support for the Andrew File System client), tracked as CVE-2026-31635 and patched upstream on 2026-04-25. The V12 security team released a public proof-of-concept (poc.c) on 2026-05-18, demonstrating root access on Linux distributions built with CONFIG_RXGK (Fedora, Arch, openSUSE Tumbleweed). The flaw is a missing/inverted length-check in rxgk_verify_response() that passes an oversized authenticator to rxgk_decrypt_skb(), reaching skb_to_sgvec() with an impossible length — V12 weaponized the resulting page-cache corruption ('CBC' / 'COW-style' write) into a deterministic root primitive in the same vulnerability class as Dirty Frag, Fragnesia, and Copy Fail (the latter currently in CISA KEV).

- **Published:** 2026-05-18T12:00:00Z
- **Last reviewed:** 2026-07-29T18:40:37.832Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0524
- **ID:** TL-2026-0524
- **Severity:** HIGH (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-31635

## Description

DirtyDecrypt / DirtyCBC is a memory-safety vulnerability in the Linux kernel's rxrpc/rxgk module — the RxGK Kerberos-style security layer used by the in-kernel Andrew File System (AFS) client. The upstream commit description (a2567217ade9 / beee051f259a / e2f1a80d8b1e) confirms the root cause: rxgk_verify_response() decodes auth_len from the network packet and was supposed to verify that the declared authenticator length fits within the remaining packet payload. The existing check was logically inverted, so oversized RESPONSE authenticators were accepted and passed to rxgk_decrypt_skb(), which then forwarded the impossible length to skb_to_sgvec() in net/core/skbuff.c, triggering BUG_ON(len) and, on V12's weaponized path, a controlled out-of-bounds write into adjacent skb fragment pages.

Will Dormann of Tharros (formerly CERT/CC) mapped the V12 PoC to CVE-2026-31635 after the V12 team reported the bug to upstream on 2026-05-09 and were informed their report was a duplicate of the mainline patch already shipped two weeks earlier. V12's poc.c reframes the kernel BUG as a deterministic LPE primitive by abusing the page-cache aliasing path inside the rxrpc receive workqueue (rxrpc_process_connection -> conn_event -> rxgk_verify_response -> rxgk_decrypt_skb). Because the affected skb data is decrypted in-place into pagecache-backed fragments that are also mapped read-only into user processes (the 'CBC decrypt to pagecache' anti-pattern that gives DirtyCBC its name), an unprivileged local attacker can race the kernel worker to overwrite a read-only file backing a SUID binary, yielding deterministic root on default-installed CONFIG_RXGK distros.

Exploitation prerequisites are minimal: an unprivileged local shell on a Linux system where the rxrpc/rxgk modules can be auto-loaded (default on Fedora 39+, Arch Linux, openSUSE Tumbleweed; not enabled in Ubuntu LTS or Debian stable defaults). The V12 PoC compiles to a single ELF binary, takes 6-12 seconds to land root on the published targets, and survives full ASLR/SMEP/SMAP/KPTI because the write primitive is data-only against pagecache. The fix landed on 2026-04-25 in mainline and was backported across stable trees the same day — distributions shipping kernels older than 2026-04-25 remain exploitable.

This vulnerability is the fourth in a clearly related family of Linux kernel net/decrypt page-cache write bugs that began with Dirty Frag (ipsec IPv6 fragment reassembly, 2025), Fragnesia (esp6 ESP-NULL decrypt path, 2025), and Copy Fail (CVE-2025-XXXXX, currently in CISA KEV after observed in-the-wild abuse against cloud Linux fleets). The reuse of the 'Dirty' / 'CBC' / 'Copy' naming reflects the shared root primitive — kernel-side in-place decrypt that aliases user-readable pagecache pages — and SOC/IR teams should treat DirtyDecrypt as a near-certain candidate for inclusion in CISA KEV within 4-8 weeks of public PoC.

Detection focuses on rxgk module load on hosts that have no legitimate AFS dependency, anomalous rxrpc workqueue stack traces, sudden writes to SUID binaries by non-root processes, and the V12 PoC's distinctive use of rxrpc_setsockopt(RXRPC_SECURITY_RXGK) followed by crafted RESPONSE packets to 127.0.0.1. Mitigation when patching is impossible: blacklist esp4/esp6/rxrpc modules via /etc/modprobe.d (breaks IPsec VPNs and AFS) and run `echo 3 > /proc/sys/vm/drop_caches` after any suspicious activity to evict potentially-poisoned pagecache pages.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1203 Exploitation for Client Execution
- T1068 Exploitation for Privilege Escalation
- T1548 Abuse Elevation Control Mechanism
- T1055 Process Injection
- T1601 Modify System Image
- T1574 Hijack Execution Flow
- T1685 Disable or Modify Tools
- T1543 Create or Modify System Process
- T1547 Boot or Logon Autostart Execution
- T1003 OS Credential Dumping
- T1082 System Information Discovery
- T1518 Software Discovery
- T1210 Exploitation of Remote Services
- T1499 Endpoint Denial of Service
- T1592 Gather Victim Host Information
- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1554 Compromise Host Software Binary
- T1098 Account Manipulation
- T1611 Escape to Host
- T1211 Exploitation for Stealth
- T1556 Modify Authentication Process

## Sources

- [Exploit available for new DirtyDecrypt Linux root escalation flaw](https://www.bleepingcomputer.com/news/security/exploit-available-for-new-dirtydecrypt-linux-root-escalation-flaw/)
- [NVD entry for CVE-2026-31635](https://nvd.nist.gov/vuln/detail/CVE-2026-31635)
- [Linux kernel upstream patch — rxrpc: fix oversized RESPONSE authenticator length check](https://git.kernel.org/stable/c/a2567217ade970ecc458144b6be469bc015b23e5)
- [Linux kernel stable backport commit beee051f259a](https://git.kernel.org/stable/c/beee051f259acd286fed64c32c2b31e6f5097eb5)
- [Linux kernel stable backport commit e2f1a80d8b1e](https://git.kernel.org/stable/c/e2f1a80d8b1ed6a5ae585a399c2b46500bdcc305)
- [Will Dormann / Tharros — CVE mapping disclosure thread](https://infosec.exchange/@wdormann/dirtydecrypt-cve-2026-31635)
- [V12 security team PoC release (poc.c)](https://github.com/V12-sec/dirtydecrypt-poc)
- [CISA Known Exploited Vulnerabilities Catalog (background — Copy Fail family)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0524