{"id":181690,"date":"2026-05-23T18:24:43","date_gmt":"2026-05-23T16:24:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/opublikovan-poc-dlya-dirtydecrypt-novoj-lpe-uyazvimosti-v-yadre-linux"},"modified":"2026-05-23T18:24:43","modified_gmt":"2026-05-23T16:24:43","slug":"opublikovan-poc-dlya-dirtydecrypt-novoj-lpe-uyazvimosti-v-yadre-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/opublikovan-poc-dlya-dirtydecrypt-novoj-lpe-uyazvimosti-v-yadre-linux","title":{"rendered":"A PoC for DirtyDecrypt \u2013 a new LPE vulnerability in the Linux kernel has been published.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

<\/p>\n

A proof-of-concept has been published for a vulnerability DirtyDecrypt<\/strong>, also known as DirtyCBC<\/strong>, allowing a local unprivileged user to gain root rights on certain Linux systems. The problem lies in the code rxgk<\/strong> subsystem RxRPC<\/strong> and is related to writing to the page cache due to a missing copy-on-write check in the rxgk_decrypt_skb() function. The PoC was reported by BleepingComputer on May 18, 2026; the PoC itself is hosted in the V12 team's repository<\/a>.<\/p>\n

<\/noindex><\/noindex><\/p>\n

<\/p>\n

RxRPC is a kernel-level networking protocol for Linux<\/a> over UDP, providing reliable transport for remote operations. The kernel documentation specifically states that AFS<\/strong> \u2014 Andrew File System \u2014 is an example of an application using RxRPC, and the protocol supports security negotiations for connections. This area pertains to RxGK, which is used for the secure mode of RxRPC\/AFS.<\/p>\n

<\/noindex><\/p>\n

According to V12's description, DirtyDecrypt is another variant of vulnerabilities in the CopyFail \/ Dirty Frag \/ Fragnesia<\/strong>class. They all revolve around a similar idea: improper handling of kernel memory, page cache, and buffers can allow an unprivileged local process to affect data that should be inaccessible for writing. In the case of DirtyDecrypt, it concerns \u2018rxgk pagecache write\u2019 due to the missing COW protection in rxgk_decrypt_skb().<\/p>\n

The V12 team claims to have discovered and reported the issue on May 9, 2026<\/strong>, but the maintainers responded that it was a duplicate of a previously fixed bug. Following this, the researchers published the PoC, arguing that the fix is already in the mainline kernel.<\/p>\n

The situation with CVE looks somewhat convoluted. BleepingComputer writes that there is no separate official CVE specifically for the name DirtyDecrypt at the time of publication, but analyst Will Dormann connects the details released by V12 with CVE-2026-31635<\/strong>, fixed at the end of April. The NVD database describes CVE-2026-31635 as a bug in rxrpc: the rxgk_verify_response() function incorrectly checked the length of the RESPONSE authenticator, allowing an excessively large authenticator to reach rxgk_decrypt_skb() and trigger the code to BUG_ON(len).<\/p>\n

<\/p>\n

That is, public publications link DirtyDecrypt with CVE-2026-31635<\/a><\/strong>, but the formal description of the CVE in the NVD currently appears narrower and primarily addresses the length checking bug in rxrpc rather than directly about the alias DirtyDecrypt\/DirtyCBC as a separate entry. Therefore, it is more accurate to state that DirtyDecrypt likely corresponds to or is closely related to CVE-2026-31635<\/em>, rather than claiming that this is the official CVE name.<\/p>\n

<\/noindex><\/p>\n

A kernel with the option enabled is required for operation CONFIG_RXGK<\/strong>, which includes support for RxGK for AFS clients and network transport. This significantly narrows down the affected systems, primarily focusing on distributions that quickly follow the upstream kernel, including Alpine<\/strong>, Arch Linux<\/strong> and openSUSE Tumbleweed<\/strong>. At the same time, BleepingComputer emphasizes that the published V12 PoC was only tested on Fedora and the mainline kernel.<\/p>\n

<\/p>\n

DirtyDecrypt emerged against the backdrop of a series of similarly classed Linux LPE vulnerabilities. Previously disclosed were Copy Fail<\/strong> in algif_aead, Dirty Frag<\/strong> in network components, and then Fragnesia<\/strong> in XFRM ESP-in-TCP. Microsoft described<\/a> Dirty Frag as local privilege escalation via the esp4, esp6, and rxrpc components, allowing an attacker to gain root access after obtaining local access and establish a foothold in the system.<\/p>\n

<\/noindex><\/p>\n

The practical danger of such flaws is that they are often exploited after the initial breach: for instance, after compromising an SSH account, web shell, vulnerable container, or low-privilege service user. Once root access is gained, an attacker can disable protections, read secrets, alter logs, deploy persistence, and move further through the infrastructure.<\/p>\n

Users of potentially affected rolling-release distributions are advised to install the latest kernel updates. For systems where immediate updating is not possible, temporary measures such as disabling unused rxrpc modules and related components are mentioned in publications; however, such workarounds may break AFS and some IPsec\/VPN scenarios, so they should only be applied after assessing the impact on the specific system.<\/p>\n

For most desktop and server installations, the risk is likely lower than that of Copy Fail: DirtyDecrypt necessitates a specific kernel configuration and local code execution. Nevertheless, for Fedora, Arch Linux, openSUSE Tumbleweed, and other systems with rapid kernel updates, the issue merits attention: this is no longer a theoretical report, but a vulnerability with a published PoC and a clear path to privilege escalation.<\/p>\n

Source: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d proof-of-concept \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 DirtyDecrypt, \u0442\u0430\u043a\u0436\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0439 \u043a\u0430\u043a DirtyCBC, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root \u043d\u0430 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 Linux. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0432 \u043a\u043e\u0434\u0435 rxgk \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b RxRPC \u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0437\u0430\u043f\u0438\u0441\u044c\u044e \u0432 page cache \u0438\u0437-\u0437\u0430 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 copy-on-write \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 rxgk_decrypt_skb(). \u041e \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 PoC 18 \u043c\u0430\u044f 2026 \u0433\u043e\u0434\u0430 \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u043e \u0438\u0437\u0434\u0430\u043d\u0438\u0435 BleepingComputer; \u0441\u0430\u043c PoC \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-181690","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47A PoC for DirtyDecrypt\u2014a new LPE vulnerability in the Linux kernel\u2014has been published | ProHoster","description":"A proof-of-concept for the DirtyDecrypt vulnerability, also known as DirtyCBC, allowing a local unprivileged user to gain rights, has been published.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/opublikovan-poc-dlya-dirtydecrypt-novoj-lpe-uyazvimosti-v-yadre-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d PoC \u0434\u043b\u044f DirtyDecrypt \u2014 \u043d\u043e\u0432\u043e\u0439 LPE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u044f\u0434\u0440\u0435 Linux | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d proof-of-concept \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 DirtyDecrypt, \u0442\u0430\u043a\u0436\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0439 \u043a\u0430\u043a DirtyCBC, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/opublikovan-poc-dlya-dirtydecrypt-novoj-lpe-uyazvimosti-v-yadre-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-23T16:24:43+00:00","article:modified_time":"2026-05-23T16:24:43+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/181690","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=181690"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/181690\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=181690"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=181690"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=181690"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}