CVE-2026-31635 DirtyDecrypt: public PoC for Linux kernel LPE

What happened

CVE-2026-31635, dubbed DirtyDecrypt (also known as DirtyCBC), is a vulnerability in the Linux kernel that enables LPE (Local Privilege Escalation — moving from an unprivileged user account to root on the same machine). Researchers from Zellic and V12 reported it on May 9, 2026, only to be told by kernel maintainers that it was a *duplicate* of a previously known bug.

A fully functional PoC (proof-of-concept — working exploit code that demonstrates the bug is real and exploitable) is now publicly available. The DirtyDecrypt name is a deliberate nod to DirtyPipe (CVE-2022-0847) and DirtyCow (CVE-2016-5195), two high-profile Linux LPEs that saw widespread exploitation.

Why it matters

An LPE with a public PoC in the Linux kernel is exactly the kind of bug attackers pick up fast. It's not a remote exploit — but that's a thin comfort. If an attacker already has a foothold on your system (via phishing, leaked credentials, or a compromised web app), DirtyDecrypt hands them full root.

The "duplicate" classification adds a layer of uncertainty. The original fix might be incomplete, improperly backported, or simply not yet shipped to downstream distributions. Debian, Ubuntu, RHEL, Fedora, and Alpine all have different backport timelines — don't assume "the kernel is patched" without checking the exact version.

Highest-risk environments: - VPS and cloud servers with multi-user SSH access - CI/CD pipelines where arbitrary code runs on the host - Shared hosting with user-level isolation - Containers without full kernel namespacing that share the host kernel

What to do

• Check your exact kernel version with `uname -r` and cross-reference it against your distribution's official advisory before assuming you're safe.
• Apply the kernel patch as soon as it lands in your distro. On Debian/Ubuntu: `apt-get update && apt-get upgrade linux-image-*`. On RHEL/CentOS: `yum update kernel`.
• Prioritize machines where untrusted users can execute code: CI/CD runners, shared dev environments, multi-tenant VPS.
• Check system logs for anomalous privilege escalation attempts — `/var/log/auth.log` and `dmesg` are your first stop on Linux.
• If you run a SIEM (centralized log and alert platform), add a rule to detect suspicious SUID binary execution or unexpected UID changes.

My take: the "Dirty" branding is intentional and effective — it draws attention. But what actually matters is speed. With a working PoC in the wild, the window between disclosure and active exploitation is measured in hours.