RxRPC Key Addition via add_key
Detects the addition of RxRPC tokens to the process keyring using the `add_key` system call or `keyctl` command. The RxRPC variant of the Dirty Frag (CVE-2026-43500) vulnerability leverages malicious RxRPC v1 tokens to perform an offline brute-force attack and achieve local privilege escalation via a page-cache write. Monitoring for unexpected RxRPC key additions helps identify potential exploitation of this vulnerability.
Sigma
