Cybersecurity Announcement: Linux Kernel Privilege Escalation to Root Vulnerability - Dirty Decrypt (CVE-2026-31635)
This document is the cybersecurity announcement for CVE-2026-31635, DirtyDecrypt Linux LPE vulnerability.
About the Event
DirtyDecrypt, also known as DirtyCBC, is a variant of CopyFail / DirtyFrag / Fragnesia. It was discovered on May 9, by Aaron Esau of the V12 Security Team
Actions to Consider
This attack is similar to Copy-Fail as it is a consistent Local Privilege Escalation (LPE), no race condition is necessary. Cybersecurity recommends Linux administrators evaluate their risks and follow mitigation instructions included in the articles linked in the References section. Currently, there are no vendor-provided patches to remediate this vulnerability.
If you believe you may have been compromised please contact the Office of Cybersecurity at cybersecurity@cio.wisc.edu.
Event Impact
Any local unprivileged user would be able to obtain root-level access resulting in a full system takeover. Proof of concept code is already publicly available.