Exploit to be had for brand new DirtyDecrypt Linux root escalation flaw

A lately patched native privilege escalation vulnerability within the Linux kernel’s rxgk module now has a proof-of-concept exploit that permits attackers to realize root get admission to on some Linux methods.

Named DirtyDecrypt and often referred to as DirtyCBC, this safety flaw was once additionally autonomously discovered and reported via the V12 safety staff previous this month, when the maintainers knowledgeable them that it was once a reproduction that had already been patched within the mainline.

“We discovered and reported this on Might 9, 2026, however was once knowledgeable it was once a reproduction via the maintainers,” V12 stated. “It is a rxgk pagecache write because of lacking COW guard in rxgk_decrypt_skb. See %.c for extra main points.”

Whilst there is not any authentic CVE ID related to this safety flaw, in line with Will Dormann (most important vulnerability analyst at Tharros), the guidelines from the protection researchers aligns with the main points of CVE-2026-31635, which was once patched on April 25.

A hit exploitation calls for operating a Linux kernel with the CONFIG_RXGK configuration choice, which allows RxGK safety fortify for the Andrew Document Gadget (AFS) shopper and community shipping.

This boundaries the assault floor to Linux distributions that intently observe the most recent upstream kernel releases, together with Fedora, Arch Linux, and openSUSE Tumbleweed. Alternatively, V12’s proof-of-concept exploit has simplest been examined in opposition to Fedora and the mainline Linux kernel.

DirtyDecrypt belongs to the similar vulnerability elegance as a number of different root-escalation flaws disclosed in contemporary weeks, together with Grimy Frag, Fragnesia, and Replica Fail.

Linux customers on distros doubtlessly suffering from DirtyDecrypt are recommended to put in the most recent kernel updates once conceivable.

Alternatively, those that can not straight away patch their units will have to use the similar mitigation used for Grimy Frag (alternatively, this may occasionally additionally damage IPsec VPNs and AFS dispensed community report methods):

sh -c "printf 'set up esp4 /bin/falseninstall esp6 /bin/falseninstall rxrpc /bin/falsen' > /and so forth/modprobe.d/dirtyfrag.conf; rmmod esp4 esp6 rxrpc 2>/dev/null; echo 3 > /proc/sys/vm/drop_caches; true"

Those disclosures observe contemporary experiences that attackers at the moment are actively exploiting the Replica Fail vulnerability within the wild.

The Cybersecurity and Infrastructure Safety Company (CISA) added Replica Fail to its record of flaws exploited in assaults on Might 1 and ordered federal businesses to safe their Linux units inside two weeks, via Might 15.

“This kind of vulnerability is a common assault vector for malicious cyber actors and poses important dangers to the federal undertaking,” the U.S. cybersecurity company warned.

In April, Linux distros rolled out patches for any other root-privilege escalation vulnerability (dubbed Pack2TheRoot) within the PackageKit daemon that had long gone not noted for just about 12 years.