Linux kernel LPE exploits DirtyDecrypt and PinTheft expose root access paths

Public proof-of-concept exploit code was released for DirtyDecrypt (CVE-2026-31635), a high-severity Linux kernel local privilege escalation flaw caused by a missing copy-on-write guard in rxgk_decrypt_skb() within the RxGK subsystem. The bug allows unprivileged local users to corrupt shared page-cache memory tied to privileged files or processes, potentially overwriting targets such as /etc/shadow, /etc/sudoers, or SUID binaries to gain root. Reports said the issue was quietly patched upstream in late April and primarily affects systems using mainline or rolling-release kernels with CONFIG_RXGK enabled, including Fedora, Arch Linux, and openSUSE Tumbleweed; the risk is elevated on Kubernetes worker nodes and developer workstations because exploitation can also enable container escape and theft of secrets or runtime sockets.

At the same time, researchers disclosed PinTheft, another Linux local privilege escalation exploit that abuses a double-free or refcount bug in the RDS zerocopy send path and uses io_uring fixed buffers to turn the flaw into a page-cache overwrite against a SUID-root binary. The exploit, credited to Aaron Esau of V12 Security, reportedly drains page references through failed RDS zerocopy sends, frees the page, reclaims it as page cache, and overwrites it with a malicious ELF payload that yields a root shell when executed. Mailing list discussion said a patch and proof of concept are available, with exploitability depending on the rds kernel module being present or autoloadable; Arch Linux was reported to enable it by default, while Fedora may also be exposed and Debian and Ubuntu appear to have mitigations that restrict autoloading.