Dirty Decrypt PoC Released for Linux Kernel CVE-2026-31635 LPE Vulnerability
Summary: Proof-of-concept exploit code has been released for DirtyDecrypt (aka DirtyCBC), a Linux kernel local privilege escalation flaw tracked as CVE-2026-31635 with a CVSS score of 7.5, reported by the Zellic and V12 security team on May 9, 2026 and found to duplicate an already-patched mainline issue. The defect is a missing copy-on-write guard in rxgk_decrypt_skb() that allows writes to memory pages shared with privileged processes or to the page cache of privileged files such as /etc/shadow, /etc/sudoers, or a SUID binary, affecting only distributions with CONFIG_RXGK enabled, including Fedora, Arch Linux, and openSUSE Tumbleweed.
Bottom line: A local attacker on a vulnerable host can write into the page cache of /etc/shadow or /etc/sudoers and take root, and in containerized environments a vulnerable worker node can become the path out of the pod.