Non-root user adds rxrpc_s key to keyring via keyctl (DirtyDecrypt precursor)

Ethan Andrews@eandrews

•updated Jul 29, 2026•2•0•7

Detects an unprivileged local user invoking keyctl to add a key of type rxrpc_s to a keyring they control, enabling userspace reproduction of the kernel's RxGK token encryption key derivation as part of CVE-2026-31635 (DirtyDecrypt) exploitation.