Root escalation shortly after AF_RXRPC socket activity (CVE-2026-31635 DirtyDecrypt)

Ethan Andrews@eandrews

•updated Jul 29, 2026•2•0•7

Detects a non-root local process gaining a root shell or executing a SUID-root binary shortly after AF_RXRPC (rxrpc) network socket activity on the same device, consistent with exploitation of the DirtyDecrypt RxGK decrypt-before-authentication flaw to corrupt page-cache pages of SUID-root binaries and gain root.