DirtyDecrypt / DirtyCBC local privilege escalation in Linux kernel RxRPC RXGK

This repository is a small standalone local privilege escalation exploit consisting of one C source file and a minimal README. The main file, CVE-2026-31635.c, claims to target CVE-2026-31635 ('DirtyDecrypt'), described as a Linux kernel flaw involving a missing COW guard in rxgk_decrypt_skb(). The exploit is not part of a larger framework. Structure and behavior: the program starts in main(), checks that it is not already running as root, prints the kernel version using 'uname -r', and warns that the target system must support CONFIG_RXGK=y. It then creates new user and network namespaces using clone(CLONE_NEWUSER|CLONE_NEWNET). Inside the child namespace it writes to /proc/self/uid_map and /proc/self/setgroups, then sets up an AF_RXRPC socket and adds an RXGK key with description 'rxgk:127.0.0.1'. The socket is bound to loopback (127.0.0.1) using a sockaddr_rxrpc structure. Exploit capability: after setup, it loads /etc/passwd into page cache, reads its current contents, checks whether a 'dirtyroot' account already exists, and then attempts to append the hardcoded payload 'dirtyroot::0:0:root:/root:/bin/bash\n' one byte at a time by repeatedly calling trigger_decrypt(), which sends crafted data through sendmsg() on the AF_RXRPC socket. If verification succeeds, it reports success and attempts privilege use in two ways: first by invoking 'su dirtyroot -c 'whoami && exec /bin/bash'', then by directly trying setuid(0)/setgid(0) and execing interactive shells from common paths. Overall purpose: this is an operational local kernel LPE proof-of-concept with a built-in post-exploitation payload. It does not merely detect vulnerability; it attempts actual privilege escalation by modifying /etc/passwd and obtaining an interactive root shell. There are no external C2 endpoints or remote network targets beyond local loopback and kernel interfaces used to trigger the vulnerability.