DirtyDecrypt Linux kernel root escalation exploit public availability
Summary
Hide ▲
Show ▼
A proof-of-concept exploit for DirtyDecrypt (DirtyCBC), a Linux kernel local privilege escalation vulnerability, has been publicly released, enabling attackers to achieve root access on systems running vulnerable kernels. The flaw stems from a missing copy-on-write (COW) guard in the rxgk module’s rxgk_decrypt_skb function, leading to a pagecache write vulnerability. Exploitation requires the CONFIG_RXGK kernel configuration option, limiting affected systems to distributions closely tracking upstream kernels such as Fedora, Arch Linux, and openSUSE Tumbleweed. The vulnerability joins a growing class of recent Linux root-escalation flaws, including Dirty Frag, Fragnesia, and Copy Fail, and follows active exploitation of Copy Fail in the wild.
Timeline
-
18.05.2026 10:18 1 articles · 20h ago
DirtyDecrypt exploit public release and Linux kernel patch alignment identified
A proof-of-concept exploit for DirtyDecrypt (DirtyCBC) was publicly released on May 18, 2026, enabling local privilege escalation to root on Linux systems with CONFIG_RXGK enabled. The vulnerability’s technical details align with CVE-2026-31635, which was patched in the mainline kernel on April 25, 2026. Exploitation has been demonstrated against Fedora and mainline kernels, with mitigations requiring module disabling and cache clearing that may impact IPsec VPNs and AFS functionality.
Show sources
- Exploit available for new DirtyDecrypt Linux root escalation flaw — www.bleepingcomputer.com — 18.05.2026 10:18
Information Snippets
-
DirtyDecrypt is a local privilege escalation flaw in the Linux kernel’s rxgk module, enabling attackers to gain root access on vulnerable systems.
First reported: 18.05.2026 10:181 source, 1 articleShow sources
- Exploit available for new DirtyDecrypt Linux root escalation flaw — www.bleepingcomputer.com — 18.05.2026 10:18
-
The vulnerability arises from a missing copy-on-write (COW) guard in rxgk_decrypt_skb, resulting in a pagecache write condition.
First reported: 18.05.2026 10:181 source, 1 articleShow sources
- Exploit available for new DirtyDecrypt Linux root escalation flaw — www.bleepingcomputer.com — 18.05.2026 10:18
-
A proof-of-concept exploit has been publicly released, demonstrating practical exploitation against Fedora and mainline Linux kernels.
First reported: 18.05.2026 10:181 source, 1 articleShow sources
- Exploit available for new DirtyDecrypt Linux root escalation flaw — www.bleepingcomputer.com — 18.05.2026 10:18
-
Exploitation requires the CONFIG_RXGK kernel configuration option, which enables RxGK security support for the Andrew File System (AFS) client and network transport.
First reported: 18.05.2026 10:181 source, 1 articleShow sources
- Exploit available for new DirtyDecrypt Linux root escalation flaw — www.bleepingcomputer.com — 18.05.2026 10:18
-
Affected Linux distributions include Fedora, Arch Linux, and openSUSE Tumbleweed, which closely follow upstream kernel releases.
First reported: 18.05.2026 10:181 source, 1 articleShow sources
- Exploit available for new DirtyDecrypt Linux root escalation flaw — www.bleepingcomputer.com — 18.05.2026 10:18
-
The vulnerability aligns with technical details of CVE-2026-31635, patched on April 25, though no official CVE ID has been assigned to DirtyDecrypt.
First reported: 18.05.2026 10:181 source, 1 articleShow sources
- Exploit available for new DirtyDecrypt Linux root escalation flaw — www.bleepingcomputer.com — 18.05.2026 10:18
-
Mitigation involves disabling specific kernel modules (esp4, esp6, rxrpc) and clearing page caches, though this may disrupt IPsec VPNs and AFS distributed networks.
First reported: 18.05.2026 10:181 source, 1 articleShow sources
- Exploit available for new DirtyDecrypt Linux root escalation flaw — www.bleepingcomputer.com — 18.05.2026 10:18