DirtyDecrypt PoC Released: Linux Kernel Flaw Grants Root

Security researchers at Zellic and V12 have released a proof-of-concept exploit for DirtyDecrypt, a Linux kernel privilege escalation vulnerability that lets unprivileged users write directly to sensitive system files. The flaw, tracked as CVE-2026-31635, carries a CVSS score of 7.5.

DirtyDecrypt represents the latest entry in a growing cluster of Linux kernel flaws exploiting copy-on-write (COW) bypass techniques. This vulnerability joins Dirty Frag, Copy Fail, and Fragnesia in a bug class that security researchers have been actively mining since April.

How DirtyDecrypt Works

The vulnerability resides in the rxgk_decrypt_skb() function within the RxGK subsystem. RxGK provides GSSAPI-based security for the RxRPC network protocol, which underpins the Andrew File System (AFS) and OpenAFS implementations.

When decrypting incoming socket buffers, the kernel is supposed to create a private copy of shared memory pages before writing to them. This copy-on-write mechanism prevents one process from inadvertently corrupting another's data. DirtyDecrypt exploits a missing COW guard that allows oversized response authenticators to bypass this protection.

"In this code path the kernel handles memory pages that are partly shared with the page cache of other processes," the Zellic research team explained. "A normal Linux optimisation protected by copy-on-write: as soon as a write to a shared page happens, a private copy is made beforehand so that the write doesn't bleed into another process's data."

Without that safeguard, attackers can write arbitrary data to privileged file caches, including /etc/shadow, /etc/sudoers, or SUID binaries. The result is reliable local privilege escalation to root.

Affected Distributions

Unlike Dirty Frag, which affected nearly every Linux distribution, DirtyDecrypt only impacts systems where the CONFIG_RXGK kernel option is compiled and enabled:

• Fedora (all recent versions)
• Arch Linux
• openSUSE Tumbleweed

Stable enterprise distributions ship with RxGK disabled by default. RHEL 8/9, Debian Stable, and Ubuntu LTS are generally not vulnerable unless administrators explicitly enabled RxGK support.

Container environments present additional risk. If the underlying host runs a vulnerable kernel, compromised containers could exploit DirtyDecrypt for pod escape—a concern for Kubernetes clusters running Fedora-based or Arch-based worker nodes. Combined with recent supply chain attacks targeting developer tools, attackers gaining initial access through compromised packages could immediately escalate to root.

Timeline and Disclosure

The V12 security team discovered the flaw and reported it to Linux kernel maintainers on May 9, 2026. Maintainers responded that the issue was actually a duplicate of a vulnerability already patched in mainline—though the patch hadn't propagated to affected distribution kernels.

On May 18, Zellic and V12 published their PoC exploit on GitHub after determining that public disclosure would accelerate patching for rolling-release distributions. The PoC has been validated against both Fedora and mainline Linux kernels.

Part of a Larger Pattern

DirtyDecrypt is the fourth major Linux kernel privilege escalation disclosed in three weeks. All share similar exploitation primitives:

• Copy Fail (CVE-2026-31431) — Modifies setuid-root binaries in memory
• Dirty Frag (CVE-2026-43284, CVE-2026-43500) — Chains ESP and RxRPC flaws for deterministic root
• Fragnesia (CVE-2026-46300) — Exploits the XFRM ESP-in-TCP subsystem

The clustering isn't coincidental. After Copy Fail's disclosure triggered widespread attention, multiple research teams began auditing related kernel subsystems. The page cache corruption technique proved more broadly applicable than initially recognized.

For defenders, this means patching one vulnerability doesn't eliminate the risk. Each new disclosure targets a different kernel module, and rolling-release distributions face particularly acute exposure as they adopt new features like RxGK before enterprise distributions.

Mitigation Options

For affected distributions:

1. Update immediately — Fedora, Arch, and openSUSE have released kernel updates addressing CVE-2026-31635
2. Verify RxGK status — Check if your kernel has RxGK enabled: grep CONFIG_RXGK /boot/config-$(uname -r)
3. Disable if unused — Most environments don't need AFS support. If the module isn't required, blacklist it

For enterprise distributions:

RHEL, Debian, and Ubuntu users running default kernels are not affected. However, if you've enabled RxGK for AFS/OpenAFS deployments, apply vendor patches as they become available.

For container environments:

Audit your worker node operating systems. Standard container-optimized distributions (Bottlerocket, Flatcar) don't include RxGK. Custom Fedora-based or Arch-based nodes require immediate patching.

Why This Matters

DirtyDecrypt's limited distribution footprint means fewer systems are vulnerable compared to Dirty Frag. But for affected environments—particularly Arch and Fedora desktop users, development workstations, and rolling-release container hosts—the risk is immediate.

The broader concern is the bug class itself. Four major COW bypass vulnerabilities in three weeks suggests more are coming. This pattern mirrors what we saw with the LiteSpeed privilege escalation earlier this week—public exploits appearing faster than patches can propagate. Security teams managing Linux infrastructure should assume their patching cadence will need to accelerate for the foreseeable future.

If you're running affected distributions, patch now. If you're on enterprise distributions, verify RxGK is disabled and monitor vendor advisories. The window between PoC publication and active exploitation continues to shrink with each disclosure in this cluster.