Anomalous splice() Syscall Mapping SUID-root Binary FDs into Network Socket Buffers

Ethan Andrews@eandrews

•updated Jul 29, 2026•1•0•8

Detects local processes invoking the splice() syscall with the MSG_SPLICE_PAGES flag to map file descriptors of readable SUID-root binaries directly into network socket buffers. This is the core technique behind CVE-2026-31635 (DirtyDecrypt), which corrupts the page cache of SUID-root binaries by placing their pages into attacker-controlled network packets before authentication completes.