Proof-of-concept (PoC) exploit code is now available for the Linux kernel vulnerability known as DirtyDecrypt, also referred to as DirtyCBC. Multiple reports say the issue was addressed by kernel maintainers earlier this year, with patches applied in April. The underlying flaw affects the kernel’s handling of memory or cryptographic operations and can be exploited by local attackers to gain higher privileges, potentially reaching root (local privilege escalation, or LPE).
One report describes DirtyDecrypt’s behavior as enabling local privilege elevation and notes that the vulnerability is associated with a specific CVE identifier (CVE-2026-31635). Another report states that the vulnerability was discovered and reported in early May by the Zellic and V12 security teams. That report adds that maintainers later informed the reporters that the submission was a duplicate of an issue already tracked and patched.
Across sources, the key common points are that the PoC has been released publicly, the vulnerability was patched in April, and exploitation is intended for local attackers seeking privilege escalation.
