DirtyDecrypt Linux Kernel Vulnerability PoC Exploit Code Released

Key Takeaways

• A high-severity local privilege escalation (LPE) vulnerability, dubbed DirtyDecrypt (CVE-2026-31635), has a public proof-of-concept (PoC) exploit available.
• The flaw affects Linux kernels configured with the RxGK subsystem, primarily impacting rolling-release distributions like Fedora, Arch Linux, and openSUSE Tumbleweed.
• DirtyDecrypt allows local, unprivileged attackers to achieve full root access by corrupting sensitive system files.
• A patch was quietly merged upstream on April 25, 2026, and immediate kernel updates are the recommended mitigation.
• The vulnerability presents a significant risk in container environments, potentially leading to full container escapes on affected Kubernetes worker nodes.

A critical local privilege escalation (LPE) vulnerability within the Linux kernel, identified as CVE-2026-31635 and named DirtyDecrypt (also known as DirtyCBC), now has a functional proof-of-concept (PoC) exploit circulating. This exploit enables local attackers to elevate their privileges to full root access on vulnerable systems.

The security community has been tracking this flaw, with security analyst Will Dormann providing technical attribution to CVE-2026-31635. Notably, a silent patch addressing this issue was integrated into the upstream Linux kernel on April 25, 2026.

Technical Details of DirtyDecrypt

DirtyDecrypt originates in the rxgk_decrypt_skb() function, located within the Linux kernel’s RxGK subsystem. This subsystem serves as the GSS-API-based security layer for RxRPC, which is the network transport protocol utilized by the Andrew File System (AFS) client.

According to researcher Moselwal, the core issue is a missing copy-on-write (COW) guard. When the kernel processes an incoming socket buffer (sk_buff) for decryption, it directly writes to a shared page-cache page. Crucially, it does so without first creating a private copy of that page.

This unguarded write operation allows an unprivileged local user to inject data into memory regions belonging to privileged processes or sensitive files within the page cache. This includes critical files such as /etc/shadow, /etc/sudoers, or SUID binaries. The ability to corrupt and ultimately overwrite these pages provides a direct path to achieving root-level access.

The vulnerability was initially described by V12 as “rxgk pagecache write due to missing COW guard in rxgk_decrypt_skb.” V12 reported the finding to kernel maintainers on May 9, 2026, only to be informed that it was a duplicate of an internally identified issue that had already been patched.

Affected Distributions and Scope

Exploitation of DirtyDecrypt is contingent on the Linux kernel being compiled with either CONFIG_RXGK=y or CONFIG_RXGK=m. This configuration is predominantly found in rolling-release distributions that closely track upstream kernel development. Affected distributions typically include:

• Fedora (including Rawhide and Workstation, prior to the patch)
• Arch Linux (before a system update via pacman -Syu)
• openSUSE Tumbleweed (before a system update via zypper dup)
• Systems utilizing mainline kernel PPAs or ELRepo kernel-ml on RHEL/CentOS Stream

In contrast, stable enterprise distributions such as Debian Stable, RHEL 8/9, and Ubuntu LTS are generally not affected by default, as they typically ship with the RxGK module disabled. Administrators can confirm their exposure by executing the following command:

zcat /proc/config.gz | grep RXGK

The threat landscape for DirtyDecrypt significantly intensifies in containerized environments. On a Kubernetes worker node running a vulnerable rolling-release kernel, successful exploitation can lead to a full container escape. As Moselwal explained, achieving local root on the host grants an attacker access to all pods, container runtime sockets, and Kubernetes secrets mounted on that node.

Within enterprise settings, developer workstations running Fedora or Arch are considered high-risk targets, especially if they commonly hold active kubectl contexts, AWS production profiles, or SSH keys.

DirtyDecrypt represents the fourth Linux kernel LPE vulnerability discovered within the XFRM/ESP/rxgk attack surface in a span of three weeks. It belongs to the same class of vulnerabilities as the actively exploited Copy Fail family.

What You Should Do

• Apply Kernel Updates Immediately: The most critical mitigation is to update your Linux kernel to a version that includes the patch released on April 25, 2026. Specific commands for common affected distributions are:
  • Fedora: sudo dnf upgrade --refresh kernel kernel-core kernel-modules && sudo systemctl reboot
  • Arch Linux: sudo pacman -Syu linux linux-headers && sudo systemctl reboot
  • openSUSE Tumbleweed: sudo zypper dup && sudo systemctl reboot
• Verify RxGK Configuration: For systems where immediate patching is not feasible, confirm if the CONFIG_RXGK option is enabled using zcat /proc/config.gz | grep RXGK. If it is not enabled, your system is likely not affected by default.
• Blacklist Kernel Modules (Temporary Workaround): If patching is impossible and RxGK is enabled, consider temporarily blacklisting the rxrpc, esp4, and esp6 kernel modules. Be aware that this will disrupt IPsec VPN connections and AFS mounts.
• Kubernetes Specific Actions:
  • Rebuild worker node images with the patched kernel.
  • Enforce pod security standards (specifically the restricted profile) cluster-wide.
  • Ensure allowPrivilegeEscalation: false is set as a default across all workloads to prevent privilege escalation within containers.
• Prioritize Developer Workstations: Given the high-risk nature of developer machines with sensitive credentials, ensure these systems are updated as a top priority.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.