Executive Summary
CVE-2026-31635, also known as DirtyDecrypt or DirtyCBC, is a critical local privilege escalation vulnerability in the RxGK security layer of the Linux kernel's AF_RXRPC networking stack. The flaw allows an unprivileged local user to corrupt the page cache of readable SUID-root binaries by exploiting the kernel's practice of decrypting network data in-place before verifying its authenticity.
Technically, the vulnerability leverages the `splice()` and `MSG_SPLICE_PAGES` functions to place victim file pages directly into an attacker-controlled network packet. By manipulating the CBC (Cipher Block Chaining) decryption process, the attacker can force the kernel to write chosen bytes into these shared pages. Because the HMAC verification occurs after the write has already damaged the page cache, the malicious changes persist even if the connection is aborted.
This vulnerability poses a significant risk to Linux-based environments as it provides a reliable path for unprivileged users to obtain root access. Organizations should prioritize patching affected kernels and monitoring for unusual `splice` activity or RxRPC socket behavior.