A vulnerability has been identified in the Linux kernel, similar to the Copy Fail, Dirty Frag, and Fragnesia vulnerabilities, allowing an unprivileged user to gain root rights by overwriting data in the page cache. The vulnerability has been assigned the code name DirtyDecrypt (the issue is also referred to as DirtyCBC). A prototype exploit is available.
The CVE identifier is not mentioned in the exploit note, only stating that researchers identified the issue on May 9, after which they informed the kernel developers, who replied that their finding duplicates another report on a previously fixed vulnerability. Since the patch for the fix has already been included in the kernel, the researchers decided to publish the exploit they developed. According to the description within the exploit, it exploits the CVE-2026-31635 vulnerability, a fix for which was accepted into the kernel in April and included in the 7.0.0 branch and the release of version 6.18.23 formed on April 18. The problem emerges starting with kernel version 6.16.
As with the series of Dirty Frag vulnerabilities, the new vulnerability is present in the RxRPC driver, which implements the AF_RXRPC socket family and the namesake RPC protocol operating over UDP. The problem is caused by an error in data size verification in the rxgk_verify_response() function — instead of checking "if (auth_len > len)" the code incorrectly specifies "if (auth_len < len)", leading to the passing of data larger than allowed to the rxgk_decrypt_skb() function. During the execution of rxgk_decrypt_skb(), data decryption occurred without additional buffering by directly substituting changes into the page cache. Due to the incorrect size check, there was a possibility of overwriting data in the page cache at the selected offset.
Exploiting the vulnerability involves reading a program file with the suid root flag (to have it reside in the page cache) and replacing part of the program's code in the page cache with code to launch /usr/bin/sh. Subsequent execution of the program will cause a modified copy from the page cache to be loaded into memory instead of the original executable file from the storage. The exploit allows the use of programs like "/usr/bin/su", "/bin/su", "/usr/bin/mount", "/usr/bin/passwd", and "/usr/bin/chsh" as suid programs.
To exploit the vulnerability, the CONFIG_RXGK option must be enabled during kernel compilation, and the rxrpc.ko kernel module must be available for autoloading (it may not be compiled in some systems). The status of vulnerability mitigation in distributions can be evaluated on the following pages: Debian, Ubuntu, SUSE/openSUSE, RHEL, Arch, Fedora. As a workaround, you can block the loading of the rxrpc kernel module:
sh -c "printf 'install rxrpc /bin/false\n' > /etc/modprobe.d/dirtydecrypt.conf; rmmod rxrpc 2>/dev/null; true"
Additionally, it is worth noting the publication in the Linux kernel developers mailing list of patches that completely disable optimizations in the crypto API (AF_ALG) that use direct access to the page cache when decrypting with the 'skcipher' and 'aead' algorithms. These optimizations eliminate unnecessary data buffering but create risks of serious vulnerabilities. It is assumed that disabling them will result in only a slight decrease in performance due to an additional copy operation into a separate buffer. The patches have been accepted by the maintainer of the crypto API subsystem and included in the 'cryptodev' branch, which is developing capabilities for future mainline releases of the Linux kernel.
Source: opennet.ru
