Reported by 2 outlets

Timeline

1. original reporting

   DirtyDecrypt (CVE-2026-31635) — PoC released for fourth Dirty Frag-class Linux LPE

   bleepingcomputer.com · 149d ago · May 18th, 2026

   A proof-of-concept exploit has been released for DirtyDecrypt (also known as DirtyCBC), a local privilege escalation vulnerability in the Linux kernel's rxgk module that allows attackers to gain root access. The flaw belongs to the same page-cache corruption class as Dirty Frag, Fragnesia (both covered in prior digests), and Copy Fail (CISA KEV, May 15 deadline). Exploitation requires CONFIG_RXGK enabled, limiting the attack surface to Fedora, Arch Linux, and openSUSE Tumbleweed. CVE-2026-31635 was patched in the mainline kernel on April 25. The same mitigation used for Dirty Frag (module blacklist for esp4, esp6, rxrpc) also protects against DirtyDecrypt, at the cost of breaking IPsec VPNs and AFS.

   ---

2. update from cyberpress.org

   DirtyDecrypt (CVE-2026-31635) PoC Released — Fourth Dirty-Frag-Class Linux Kernel LPE

   cyberpress.org · 147d ago · May 20th, 2026

   A working proof-of-concept exploit for DirtyDecrypt (DirtyCBC) has been publicly released by the Zellic and V12 security team, targeting a missing copy-on-write guard in the Linux kernel's rxgk_decrypt_skb() function. The exploit allows unprivileged local users to gain root by writing to shared page-cache pages belonging to privileged processes or sensitive files (/etc/shadow, /etc/sudoers, SUID binaries). Confirmed working on Fedora and mainline kernels; Arch Linux and openSUSE Tumbleweed are also vulnerable. Stable enterprise distributions (Debian, Ubuntu LTS, RHEL 8/9) are not affected under standard configurations (RxGK disabled). Kubernetes operators should note the exploit path enables container escape to full host root on affected nodes.