Linux Kernel rxgk Missing COW Guard in rxgk_decrypt_skb Allows Local Privilege Escalation (DirtyDecrypt)

CVE-2026-31635 is a Linux kernel flaw in the RxGK security class for the RxRPC protocol — the transport layer used by the Andrew File System (AFS). The function rxgk_verify_response() contains an inverted length check: it accepts oversized RESPONSE authenticator payloads instead of rejecting them. These payloads reach rxgk_decrypt_skb(), which performs AES-CBC decryption without a copy-on-write guard on shared page-cache pages. An unprivileged local user can weaponize this to corrupt the page cache of privileged files (/etc/shadow, /etc/sudoers, SUID binaries) and escalate to root. A separate remote denial-of-service path exists where a crafted rxrpc packet triggers a BUG_ON(len) kernel panic in skb_to_sgvec(). The bug affects kernels compiled with CONFIG_RXGK=y or CONFIG_RXGK=m and is fixed in upstream stable releases 6.18.23, 6.19.13, and 7.0. Affected-by-default distributions are limited to Fedora, Arch Linux, and historically openSUSE Tumbleweed. Enterprise stalwarts — RHEL, CentOS/Rocky/Alma, Ubuntu LTS, Debian Stable, and SUSE Enterprise — do not ship CONFIG_RXGK enabled and are not vulnerable in default configurations.

The NVD's vendor CVSS of 7.5 (HIGH) uses the network vector AV:N to model the remote DoS path, which is technically correct but practically misleading: the number of systems exposing rxrpc services to a network is vanishingly small, and availability-only impact (C:N/I:N/A:H) undersells the real danger. The more impactful attack is the local privilege escalation (DirtyDecrypt), which Red Hat separately scored at 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). SUSE went lower, rating it Moderate at 5.5 and marking all their enterprise products as 'Not affected.' Ubuntu assigned Medium priority. The vendor 7.5 HIGH label is therefore overstated for enterprise defenders: it conflates a theoretical network DoS on a protocol almost nobody runs with a local root exploit that only fires on rolling-release distros that most enterprises avoid in production.

Sources.

1. The Hacker News — DirtyDecrypt PoC Released
2. BleepingComputer — DirtyDecrypt Linux Root Escalation
3. SecurityWeek — PoC Released for DirtyDecrypt
4. Ubuntu Security — CVE-2026-31635
5. Red Hat Security — CVE-2026-31635
6. SUSE Security — CVE-2026-31635
7. Uganda CERT — DirtyDecrypt Technical Advisory
8. GitHub PoC — 0xBlackash/CVE-2026-31635

Run directly on each target Linux host as any user (root not required). Invoke with: bash cve-2026-31635-check.sh. The script checks whether CONFIG_RXGK is compiled into the running kernel and whether the kernel version predates the upstream fix. Note: distro-specific backport versions (e.g., Ubuntu 6.17.0-40.40) may report UNKNOWN — cross-reference with dpkg -l linux-image-$(uname -r) or rpm -q kernel for exact package status.

#!/usr/bin/env bash
# CVE-2026-31635 (DirtyDecrypt) vulnerability checker
# Exit codes: 0 = VULNERABLE, 1 = PATCHED, 2 = UNKNOWN
set -euo pipefail

KVER=$(uname -r)
echo "[*] Running kernel: $KVER"

# Step 1: Determine CONFIG_RXGK status
rxgk_enabled() {
  local cfg="/boot/config-${KVER}"
  if [ -f "$cfg" ]; then
    grep -qE '^CONFIG_RXGK=[ym]' "$cfg" 2>/dev/null && return 0
    return 1
  fi
  if [ -f /proc/config.gz ]; then
    zcat /proc/config.gz 2>/dev/null | grep -qE '^CONFIG_RXGK=[ym]' && return 0
    return 1
  fi
  # Fallback: check if rxgk module exists on disk
  if modinfo rxgk >/dev/null 2>&1; then
    return 0
  fi
  return 2
}

rxgk_enabled
rc=$?
if [ "$rc" -eq 1 ]; then
  echo "[+] CONFIG_RXGK is NOT enabled — system is not vulnerable."
  echo "PATCHED"
  exit 1
elif [ "$rc" -eq 2 ]; then
  echo "[?] Cannot determine CONFIG_RXGK status (no kernel config or module found)."
  echo "UNKNOWN"
  exit 2
fi
echo "[!] CONFIG_RXGK is ENABLED in this kernel."

# Step 2: Parse upstream version components
MAJ=$(echo "$KVER" | cut -d. -f1)
MIN=$(echo "$KVER" | cut -d. -f2)
PAT=$(echo "$KVER" | cut -d. -f3 | sed 's/[^0-9].*//')
PAT=${PAT:-0}
echo "[*] Parsed upstream base: ${MAJ}.${MIN}.${PAT}"

# Step 3: Check against fixed upstream versions (6.18.23, 6.19.13, 7.0+)
patched=false
if [ "$MAJ" -ge 7 ]; then
  patched=true
elif [ "$MAJ" -eq 6 ]; then
  if [ "$MIN" -ge 20 ]; then
    patched=true
  elif [ "$MIN" -eq 19 ] && [ "$PAT" -ge 13 ]; then
    patched=true
  elif [ "$MIN" -eq 18 ] && [ "$PAT" -ge 23 ]; then
    patched=true
  fi
fi

if $patched; then
  echo "[+] Kernel ${MAJ}.${MIN}.${PAT} includes the upstream fix."
  echo "PATCHED"
  exit 1
fi

# Step 4: Check if rxgk module is currently loaded (active risk)
if lsmod 2>/dev/null | grep -q rxgk; then
  echo "[!!] rxgk module is LOADED — actively exploitable."
else
  echo "[!] rxgk module exists but is not currently loaded."
  echo "    Load-on-demand still makes this exploitable."
fi

echo "[-] Kernel ${KVER} with CONFIG_RXGK enabled is VULNERABLE to CVE-2026-31635 (DirtyDecrypt)."
echo "VULNERABLE"
exit 0