A vulnerability has been identified in the Linux kernel, similar to the Copy Fail, Dirty Frag, and Fragnesia vulnerabilities, allowing an unprivileged user to gain root rights by overwriting data in the page cache. The vulnerability has been assigned the code name DirtyDecrypt (the issue is also referred to as DirtyCBC). A prototype exploit is available. <\/p>\n
The CVE identifier is not mentioned in the exploit note, only stating that researchers identified the issue on May 9, after which they informed the kernel developers, who replied that their finding duplicates another report on a previously fixed vulnerability. Since the patch for the fix has already been included in the kernel, the researchers decided to publish the exploit they developed. According to the description within the exploit, it exploits the CVE-2026-31635 vulnerability, a fix for which was accepted into the kernel in April and included in the 7.0.0 branch and the release of version 6.18.23 formed on April 18. The problem emerges starting with kernel version 6.16. <\/p>\n
Like the Dirty Frag vulnerability series, the new vulnerability exists in the RxRPC driver, which implements the AF_RXRPC socket family and the corresponding RPC protocol operating over UDP. The issue is caused by a data size check error in the rxgk_verify_response() function \u2014 instead of checking \"if (auth_len > len)\" the code had \"if (auth_len < len)", which led to passing data larger than permitted to the rxgk_decrypt_skb() function. When executing the rxgk_decrypt_skb() function, the data was decrypted by directly substituting changes into the page cache to avoid unnecessary buffering. The incorrect size check created a possibility of overwriting data in the page cache at the chosen offset. <\/p>\n
Exploitation of the vulnerability involves reading a program file with the suid root flag (for it to reside in the page cache) and replacing part of the program's code in the page cache with code to launch \/usr\/bin\/sh. The subsequent execution of the program will result in the memory loading not the original executable file from the storage, but the modified copy from the page cache. The exploit allows using programs such as \"\/usr\/bin\/su\", \"\/bin\/su\", \"\/usr\/bin\/mount\", \"\/usr\/bin\/passwd\", and \"\/usr\/bin\/chsh\" as suid programs. <\/p>\n
To exploit the vulnerability, the CONFIG_RXGK option must be enabled during kernel compilation, and the rxrpc.ko kernel module must be available for autoloading (it may not be compiled in some systems). The status of vulnerability mitigation in distributions can be evaluated on the following pages: Debian, Ubuntu, SUSE\/openSUSE, RHEL, Arch, Fedora. As a workaround, you can block the loading of the rxrpc kernel module: <\/p>\n
sh -c \"printf 'install rxrpc \/bin\/false\\n' > \/etc\/modprobe.d\/dirtydecrypt.conf; rmmod rxrpc 2>\/dev\/null; true\" <\/p>\n
Additionally, it is worth noting the publication in the Linux kernel developers' mailing list of patches that completely disable optimizations in the crypto API (AF_ALG), which use direct access to the page cache during decryption with the algorithms \"skcipher\" and \"aead\". These optimizations eliminate unnecessary data buffering but create risks of serious vulnerabilities. The expectation is that their disabling will only lead to a slight decrease in performance due to the introduction of an additional copy operation into a separate buffer. The patches have been accepted by the maintainer of the crypto API subsystem and included in the \"cryptodev\" branch, which develops capabilities for inclusion in future kernel releases. \u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0438 \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 Copy Fail, Dirty Frag \u0438 Fragnesia \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root, \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u0432 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u043e\u043c \u043a\u044d\u0448\u0435. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f DirtyDecrypt (\u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0442\u0430\u043a\u0436\u0435 \u0443\u043f\u043e\u043c\u0438\u043d\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u0438\u043c\u0435\u043d\u0435\u043c DirtyCBC). \u0414\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043f\u0440\u043e\u0442\u043e\u0442\u0438\u043f \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430. CVE-\u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 \u0432 \u043f\u0440\u0438\u043c\u0435\u0447\u0430\u043d\u0438\u0438 \u043a \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0443 \u043d\u0435 \u0443\u043f\u043e\u043c\u0438\u043d\u0430\u0435\u0442\u0441\u044f, \u0443\u043a\u0430\u0437\u0430\u043d\u043e \u043b\u0438\u0448\u044c, \u0447\u0442\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 9 \u043c\u0430\u044f, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-172665","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47DirtyDecrypt \u2014 another vulnerability in the Copy Fail class that provides root privileges in Linux | ProHoster","description":"A vulnerability has been discovered in the Linux kernel, similar to the Copy Fail, Dirty Frag, and Fragnesia vulnerabilities, that allows an unprivileged user to gain root privileges by overwriting data in the page cache.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/dirtydecrypt-ocherednaya-uyazvimost-klassa-copy-fail-predostavlyayushhaya-prava-root-v-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47DirtyDecrypt \u2014 \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043b\u0430\u0441\u0441\u0430 Copy Fail, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u0440\u0430\u0432\u0430 root \u0432 Linux | ProHoster","og:description":"\u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0438 \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 Copy Fail, Dirty Frag \u0438 Fragnesia \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root, \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u0432 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u043e\u043c \u043a\u044d\u0448\u0435.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/dirtydecrypt-ocherednaya-uyazvimost-klassa-copy-fail-predostavlyayushhaya-prava-root-v-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-18T22:24:34+00:00","article:modified_time":"2026-05-18T22:24:34+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/172665","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=172665"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/172665\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=172665"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=172665"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=172665"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"