{"id":181690,"date":"2026-05-23T18:24:43","date_gmt":"2026-05-23T16:24:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/opublikovan-poc-dlya-dirtydecrypt-novoj-lpe-uyazvimosti-v-yadre-linux"},"modified":"2026-05-23T18:24:43","modified_gmt":"2026-05-23T16:24:43","slug":"opublikovan-poc-dlya-dirtydecrypt-novoj-lpe-uyazvimosti-v-yadre-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/opublikovan-poc-dlya-dirtydecrypt-novoj-lpe-uyazvimosti-v-yadre-linux","title":{"rendered":"PoC for DirtyDecrypt \u2014 en ny LPE-s\u00e5rbarhed i Linux-kernen er offentliggjort","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

<\/p>\n

Proof-of-concept for a vulnerability has been published DirtyDecrypt<\/strong>, also known as DirtyCBC<\/strong>, which allows a local unprivileged user to gain root rights on certain Linux systems. The problem lies in the code of rxgk<\/strong> subsystem RxRPC<\/strong> and is related to writing to the page cache due to the lack of a copy-on-write check in the function rxgk_decrypt_skb(). The publication of the PoC was reported by BleepingComputer on May 18, 2026; the PoC itself is hosted in the V12 team's repository<\/a>.<\/p>\n

<\/noindex><\/noindex><\/p>\n

<\/p>\n

RxRPC is a Linux kernel network protocol<\/a> over UDP, providing reliable transport for remote operations. It is specifically mentioned in the kernel documentation that AFS<\/strong> \u2014 Andrew File System \u2014 is an example of an application using RxRPC, and the protocol supports negotiations for connection security. This area pertains to RxGK, used for secure RxRPC\/AFS mode.<\/p>\n

<\/noindex><\/p>\n

According to V12, DirtyDecrypt is yet another variant of vulnerabilities in the class of CopyFail \/ Dirty Frag \/ Fragnesia<\/strong>. They all revolve around a similar idea: incorrect handling of kernel memory, page cache, and buffers can allow an unprivileged local process to affect data that should be inaccessible for writing. In the case of DirtyDecrypt, it concerns \"rxgk pagecache write\" due to the lack of COW protection in rxgk_decrypt_skb().<\/p>\n

The V12 team claims to have discovered and reported the problem on May 9, 2026<\/strong>, but the kernel maintainers responded that this is a duplicate of an already fixed bug. Following this, researchers published the PoC, arguing that the fix is already in the mainline kernel.<\/p>\n

The situation with CVE does not appear straightforward. BleepingComputer reports that there is no separate official CVE specifically for the name DirtyDecrypt at the time of publication, but analyst Will Dormann links the published V12 details with CVE-2026-31635<\/strong>, fixed at the end of April. The NVD database describes CVE-2026-31635 as a bug in rxrpc: the function rxgk_verify_response() incorrectly checked the length of the RESPONSE authenticator, allowing an excessively large authenticator to pass into rxgk_decrypt_skb(), leading the code to BUG_ON(len).<\/p>\n

<\/p>\n

Thus, public publications link DirtyDecrypt with CVE-2026-31635<\/a><\/strong>, but the formal description of CVE in NVD still appears narrower, stating primarily the length-checking error in rxrpc, rather than directly regarding the alias DirtyDecrypt\/DirtyCBC as a separate entry. Therefore, it is more accurate to write: DirtyDecrypt likely corresponds to or is closely related to CVE-2026-31635<\/em>, og ikke h\u00e6vde, at det er det officielle navn CVE.<\/p>\n

<\/noindex><\/p>\n

For at udnytte det kr\u00e6ves en kerne med den aktiverede indstilling CONFIG_RXGK<\/strong>, som aktiverer st\u00f8tte til RxGK for AFS-klienten og netv\u00e6rkstransport. Dette indsn\u00e6vrer markant omfanget af ber\u00f8rte systemer: der henvises f\u00f8rst og fremmest til distributioner, der hurtigt f\u00f8lger efter upstream-kernen, herunder Fedora<\/strong>, Arch Linux<\/strong> og openSUSE Tumbleweed<\/strong>. Samtidig understreger BleepingComputer, at den offentliggjorte V12 PoC kun er blevet testet p\u00e5 Fedora og mainline-kernen.<\/p>\n

<\/p>\n

DirtyDecrypt opstod i k\u00f8lvandet p\u00e5 en r\u00e6kke n\u00e6rt besl\u00e6gtede Linux LPE-s\u00e5rbarheder. Tidligere blev det afsl\u00f8ret Copy Fail<\/strong> i algif_aead, Dirty Frag<\/strong> i netv\u00e6rkskomponenter, og derefter Fragnesia<\/strong> i XFRM ESP-in-TCP. Microsoft beskrev<\/a> Dirty Frag som lokal forh\u00f8jelse af privilegier gennem komponenter esp4, esp6 og rxrpc, hvilket tillader en angriber at opn\u00e5 root-adgang og forblive i systemet efter at have f\u00e5et lokal adgang.<\/p>\n

<\/noindex><\/p>\n

Den praktiske fare ved s\u00e5danne fejl er, at de ofte bruges efter det prim\u00e6re brud: for eksempel efter kompromittering af en SSH-konto, web shell, en s\u00e5rbar container eller en lavprivilegeret servicebruger. N\u00e5r angriberen har opn\u00e5et root-adgang, kan de deaktivere beskyttelsesforanstaltninger, l\u00e6se hemmeligheder, \u00e6ndre logfiler, implementere persistence og bev\u00e6ge sig videre i infrastrukturen.<\/p>\n

Brugere af potentielt ber\u00f8rte rolling-release distributioner anbefales at installere de nyeste kernelopdateringer. For systemer, hvor \u00f8jeblikkelig opdatering ikke er muligt, n\u00e6vnes der midlertidige foranstaltninger i publikationer som at deaktivere ubrugte rxrpc-moduler og relaterede komponenter, dog kan s\u00e5danne omg\u00e5elsesl\u00f8sninger bryde AFS og nogle IPsec\/VPN-scenarier, s\u00e5 de b\u00f8r kun anvendes efter at have vurderet indflydelsen p\u00e5 det specifikke system.<\/p>\n

For de fleste desktop- og serverinstallationer er risikoen sandsynligvis lavere end for Copy Fail: DirtyDecrypt kr\u00e6ver en specifik kernelkonfiguration og lokal udf\u00f8relse af kode. Ikke desto mindre, for Fedora, Arch Linux, openSUSE Tumbleweed og andre systemer med hurtige kernelopdateringer, fortjener problemet opm\u00e6rksomhed: dette er ikke l\u00e6ngere en teoretisk rapport, men en s\u00e5rbarhed med offentliggjort PoC og en klar vej til forh\u00f8jelse af privilegier.<\/p>\n

Kilde: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d proof-of-concept \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 DirtyDecrypt, \u0442\u0430\u043a\u0436\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0439 \u043a\u0430\u043a DirtyCBC, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root \u043d\u0430 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 Linux. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0432 \u043a\u043e\u0434\u0435 rxgk \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b RxRPC \u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0437\u0430\u043f\u0438\u0441\u044c\u044e \u0432 page cache \u0438\u0437-\u0437\u0430 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 copy-on-write \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 rxgk_decrypt_skb(). \u041e \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 PoC 18 \u043c\u0430\u044f 2026 \u0433\u043e\u0434\u0430 \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u043e \u0438\u0437\u0434\u0430\u043d\u0438\u0435 BleepingComputer; \u0441\u0430\u043c PoC \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-181690","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Der er offentliggjort PoC for DirtyDecrypt \u2014 en ny LPE-s\u00e5rbarhed i Linux-kernen | ProHoster","description":"Der er offentliggjort proof-of-concept for s\u00e5rbarheden DirtyDecrypt, ogs\u00e5 kendt som DirtyCBC, der tillader en lokal ikke-privilegeret bruger at opn\u00e5 rettigheder.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/opublikovan-poc-dlya-dirtydecrypt-novoj-lpe-uyazvimosti-v-yadre-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d PoC \u0434\u043b\u044f DirtyDecrypt \u2014 \u043d\u043e\u0432\u043e\u0439 LPE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u044f\u0434\u0440\u0435 Linux | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d proof-of-concept \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 DirtyDecrypt, \u0442\u0430\u043a\u0436\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0439 \u043a\u0430\u043a DirtyCBC, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/opublikovan-poc-dlya-dirtydecrypt-novoj-lpe-uyazvimosti-v-yadre-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-23T16:24:43+00:00","article:modified_time":"2026-05-23T16:24:43+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/181690","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=181690"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/181690\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=181690"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=181690"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=181690"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}