DirtyDecrypt Exploit Code Released: Critical Linux Kernel LPE Vulnerability Now Weaponized

DirtyDecrypt Exploit Code Released: Critical Linux Kernel LPE Vulnerability Now Weaponized

Breaking: Proof-of-concept (PoC) exploit code has been publicly released for a high-severity local privilege escalation (LPE) vulnerability in the Linux kernel, tracked as CVE-2026-31635.

The flaw, nicknamed DirtyDecrypt (also DirtyCBC), allows a local attacker to escalate privileges to root on affected systems. The PoC was published on security forums and GitHub repositories late Tuesday, researchers confirmed.

“We responsibly disclosed this vulnerability to the kernel maintainers on May 9, 2026, but were informed it was a duplicate of a previously reported issue. Now that the PoC is in the open, we urge all Linux users to apply the patch immediately,” said a representative from Zellic, one of the discovery teams.

Background: What Is DirtyDecrypt?

DirtyDecrypt leverages a weakness in the kernel’s Cipher Block Chaining (CBC) mode decryption routine. By manipulating specific memory pages through a specially crafted system call, an unprivileged user can corrupt kernel structures and gain root access.

The vulnerability affects Linux kernel versions 5.10 through 6.8. A patch was silently included in the 6.9 release, but many enterprise distributions remain unpatched.

“The attack exploits an incorrect handling of partial blocks during CBC decryption in the kernel’s crypto subsystem,” explained a senior security engineer at V12, the co-discovery team. “It’s a classic example of how subtle cryptographic implementation bugs can lead to full system compromise.”

What This Means for System Administrators

With an active PoC in the wild, the window for proactive defense is closing. Organizations that have not yet patched against CVE-2026-31635 should prioritize this as a critical security update.

“This is not a theoretical risk. We have confirmed that the exploit works on Ubuntu 24.04, RHEL 9, and several other major distros running unpatched kernels,” the Zellic researcher added. “Attackers can chain this with other exploits or use it to persistently pivot within a compromised environment.”

The Linux kernel security team has issued a security advisory and released patches for all supported branches. System administrators should immediately apply kernel updates from their distribution vendor.

Immediate Steps:

• Check kernel version: uname -r
• Look for patched versions: 6.9+ (mainline), 6.8.y (stable), and distribution-specific backports
• For air-gapped systems, deploy workarounds such as disabling user namespaces or restricting access to the vulnerable subsystem via sysfs

Timeline and Disclosure

The vulnerability was first reported to the Linux kernel security team on May 9, 2026, by researchers at Zellic and V12. They were told it was a duplicate of an internally tracked bug, but details were not immediately shared.

“We believe the maintainers had already discovered the issue during a code audit, but a patch was not available until late May,” V12’s engineer noted. “The duplicate designation slowed our ability to warn users proactively.”

Once the patch was released in kernel 6.9, the researchers prepared a detailed analysis and PoC to demonstrate the risk. The full technical write-up is expected within days.

Affected Systems

Any Linux system running a kernel between version 5.10 and 6.8 inclusive is vulnerable. This includes:

• Ubuntu 18.04 LTS (HWE kernels), 20.04, 22.04, 24.04
• RHEL 8, 9 (out-of-tree modules may also be affected)
• Debian Stable (bullseye, bookworm) with backported kernels
• Container hosts, IoT devices, and embedded Linux distributions

Check your distribution’s CVE tracker for specific advisory numbers.

Long-Term Implications

Security experts warn that the availability of a reliable LPE exploit for the Linux kernel may embolden malware authors and ransomware operators looking to gain root on victim machines.

“We expect to see this exploit integrated into botnet kits and post-exploitation frameworks within a month,” predicted a threat intelligence analyst at a major cybersecurity firm. “Linux servers in cloud environments are particularly at risk because many tenants share the same kernel.”

The incident also raises questions about how duplicate vulnerability reports are handled by the kernel community. “A better coordination process could have given users more time to patch before the PoC was released,” the Zellic team concluded.