🩸 CVE-2026-31635 – DirtyDecrypt

Linux Kernel Local Privilege Escalation via RXGK Page Cache Corruption

"DirtyDecrypt" — Part of the 2026 "Dirty" family exploits

📖 Overview

DirtyDecrypt (CVE-2026-31635) is a local privilege escalation vulnerability in the Linux kernel's rxrpc subsystem (specifically the rxgk component).

It abuses a missing Copy-on-Write (COW) check during AES-CBC decryption, allowing an unprivileged user to corrupt page cache and achieve arbitrary file writes, leading to root access.

✨ Features

• ✅ Clean & well-commented C code
• ✅ User + Network namespace support
• ✅ Reliable page cache write primitive
• ✅ Targets /etc/passwd (blank root password)
• ✅ Easy to modify for SUID binaries or other targets
• ✅ Static compilation support

🛠️ Affected Systems

• Vulnerable Kernels: 6.10 ~ 6.13 (with CONFIG_RXGK=y)
• Common Distros: Fedora, Arch Linux, openSUSE Tumbleweed, custom kernels
• Not Vulnerable: Kernels before ~6.10 or those with CONFIG_RXGK=n

📋 Requirements

• Linux kernel with CONFIG_RXGK enabled
• Unprivileged local user access
• AF_RXRPC socket support
• keyctl utility (for rxrpc keys)

🚀 Compilation

git clone https://github.com/0xBlackash/DirtyDecrypt.git
cd DirtyDecrypt
gcc -O2 -static -pthread CVE-2026-31635.c -o DirtyDecrypt

💥 Usage

sudo ./DirtyDecrypt

Expected successful output:

=== rxgk pagecache write (DirtyDecrypt) ===
uid=1000 euid=1000

[*] writing shellcode to /usr/bin/su (96 bytes from offset 0)
    [========================================] 100% (XXX/96, YYYY fires)
[*] XXX fires in Z.Zs
[*] exec /usr/bin/su
[*] restore: cp /tmp/.su_12345 /usr/bin/su

# whoami
root

# id
uid=0(root) gid=0(root) groups=0(root)

# 

📁 Repository Structure

DirtyDecrypt/
├── CVE-2026-31635.c          # Main exploit
├── README.md                 # This file
├── Makefile                  # Optional
└── exploit.log               # Optional output log

🔬 How It Works (Technical)

1. Enters User + Network namespace
2. Adds RXGK key to keyring
3. Uses AF_RXRPC sockets + splice() to force page cache pages into the RXGK decryption path
4. Triggers in-place AES-CBC decryption without skb_cow_data()
5. Corrupts target file (/etc/passwd) byte-by-byte using sliding window technique
6. Blanks root password → spawns root shell

⚠️ Disclaimer

This exploit is for educational and authorized security testing only.
Unauthorized use on systems you do not own is illegal.

📜 Credits & Author

• Exploit Author: Ashraf Zaryouh "0xBlackash"
• Original Discovery: Security researchers (2026)
• PoC Version: v2.1 (May 2026)