## https://sploitus.com/exploit?id=52E2B1D3-F89F-58A5-A1F3-B7D71B13F551
# 🩸 **CVE-2026-31635 – DirtyDecrypt**
**Linux Kernel Local Privilege Escalation via RXGK Page Cache Corruption**
### **"DirtyDecrypt"** — Part of the 2026 "Dirty" family exploits
---
## 📖 **Overview**
**DirtyDecrypt** (CVE-2026-31635) is a **local privilege escalation** vulnerability in the Linux kernel's `rxrpc` subsystem (specifically the `rxgk` component).
It abuses a **missing Copy-on-Write (COW)** check during AES-CBC decryption, allowing an unprivileged user to corrupt page cache and achieve **arbitrary file writes**, leading to **root** access.
---
## ✨ **Features**
- ✅ Clean & well-commented C code
- ✅ User + Network namespace support
- ✅ Reliable page cache write primitive
- ✅ Targets `/etc/passwd` (blank root password)
- ✅ Easy to modify for SUID binaries or other targets
- ✅ Static compilation support
---
## 🛠️ **Affected Systems**
- **Vulnerable Kernels**: 6.10 ~ 6.13 (with `CONFIG_RXGK=y`)
- **Common Distros**: Fedora, Arch Linux, openSUSE Tumbleweed, custom kernels
- **Not Vulnerable**: Kernels before ~6.10 or those with `CONFIG_RXGK=n`
---
## 📋 **Requirements**
- Linux kernel with `CONFIG_RXGK` enabled
- Unprivileged local user access
- `AF_RXRPC` socket support
- `keyctl` utility (for rxrpc keys)
---
## 🚀 **Compilation**
```bash
git clone https://github.com/0xBlackash/DirtyDecrypt.git
cd DirtyDecrypt
gcc -O2 -static -pthread CVE-2026-31635.c -o DirtyDecrypt
```
---
## 💥 **Usage**
```bash
sudo ./DirtyDecrypt
```
**Expected successful output:**
```bash
[+] === DirtyDecrypt v2 - CVE-2026-31635 ===
[+] User + Network namespace created
[+] Starting attack on /etc/passwd...
[+] SUCCESS! Got root!
uid=0(root) gid=0(root) groups=0(root)
```
---
## 📁 **Repository Structure**
```bash
DirtyDecrypt/
├── CVE-2026-31635.c # Main exploit
├── README.md # This file
├── Makefile # Optional
└── exploit.log # Optional output log
```
---
## 🔬 **How It Works (Technical)**
1. Enters User + Network namespace
2. Adds RXGK key to keyring
3. Uses `AF_RXRPC` sockets + `splice()` to force page cache pages into the RXGK decryption path
4. Triggers in-place AES-CBC decryption without `skb_cow_data()`
5. Corrupts target file (`/etc/passwd`) byte-by-byte using sliding window technique
6. Blanks root password → spawns root shell
---
## ⚠️ **Disclaimer**
> This exploit is for **educational and authorized security testing** only.
> Unauthorized use on systems you do not own is illegal.
---
## 📜 **Credits & Author**
- **Exploit Author**: Ashraf Zaryouh "0xBlackash"
- **Original Discovery**: Security researchers (2026)
- **PoC Version**: v2.1 (May 2026)
---
**⭐ Star this repo if it helped you!**
**Made with ❤️ for the research community**