tag

Rxrpc

CVE-2026-31635 binary HIGH

DirtyDecrypt-Go — RxRPC rxgk Page-Cache Overwrite LPE (Go Port) — CVE-2026-31635

This is a Go re-implementation ("port") of the original C dirtydecrypt PoC, now tracked as its own CVE (CVE-2026-31635). The bug is a missing skbcowdata() call in rxgkdecryptskb(): the krb5enc AEAD used by RxRPC's rxgk security class decrypts skb payload data…

Patched 2026-07-05

N/A binary HIGH

DirtyDecrypt / DirtyCBC — rxgk Page-Cache Write (Dirty Pipe Variant)

DirtyDecrypt (also called DirtyCBC) is a variant of the CopyFail / DirtyFrag / Fragnesia bug class. rxgkdecryptskb() in net/rxrpc/rxgkcommon.h calls skbtosgvec() followed by cryptokrb5decrypt() without first calling skbcowdata(). The krb5enc AEAD template…

Unverified 2026-05-18

CVE-2026-43500, CVE-2026-43284 binary CRITICAL 7.8 EPSS 93%

Dirty Frag: Linux XFRM/RxRPC Page Cache Write Chain LPE

Dirty Frag is a universal Linux Local Privilege Escalation (LPE) vulnerability class discovered by Hyunwoo Kim (@v4bel) that chains two Page Cache Write primitives: the xfrm-ESP Page-Cache Write (CVE-2026-43284) and the RxRPC Page-Cache Write…

Patched 2026-05-14