CVE-2026-31635: DirtyDecrypt Linux Kernel LPE Vulnerability — Detection and Remediation Guide

---
title: Potential Linux Kernel LPE via DirtyDecrypt - Sudden Root Shell from Unprivileged User
id: d1e4a5f2-8c3b-4d2e-9a1b-5c6d7e8f90a1
status: experimental
description: Detects suspicious bash or sh shells spawning with root (uid 0) immediately after execution from a non-privileged user, which may indicate successful kernel LPE exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-31635
author: Security Arsenal
date: 2026/05/12
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
      - '/bin/bash'
      - '/bin/sh'
      - '/bin/zsh'
    NewProcessUid: 0
  filter_legitimate:
    ParentImage|endswith:
      - '/usr/sbin/sshd'
      - '/usr/bin/sudo'
      - '/usr/bin/su'
      - '/usr/lib/systemd/systemd'
  condition: selection and not filter_legitimate
falsepositives:
  - Legitimate use of sudo/su from administrators
  - Scheduled cron jobs running as root
level: high
---
title: DirtyDecrypt - Suspicious Execution from Temporary Directories
id: e2f5b6g3-9d4c-5e3f-0b2c-6d7e8f9a0b1c
status: experimental
description: Detects execution of binaries or scripts from common temporary directories (/tmp, /var/tmp, /dev/shm) which are frequently used for staging LPE exploit payloads.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-31635
author: Security Arsenal
date: 2026/05/12
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|startswith:
      - '/tmp/'
      - '/var/tmp/'
      - '/dev/shm/'
  filter_known_good:
    Image|contains:
      - 'vendor'
      - 'package'
  condition: selection and not filter_known_good
falsepositives:
  - Software installations from temp directories
  - Developer build processes
level: medium
---
title: DirtyDecrypt - Linux Kernel Version Check for Vulnerable Builds
id: f3g6c7h4-0e5d-6f4g-1c3d-7e8f9a0b1c2d
status: experimental
description: Identify systems running vulnerable Linux kernel versions prior to patches for CVE-2026-31635. Use with asset inventory data.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-31635
author: Security Arsenal
date: 2026/05/12
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: system
  product: linux
detection:
  selection:
    kernel_version|startswith:
      - '5.15'
      - '6.1'
      - '6.5'
  filter_patched:
    kernel_version|contains:
      - '.1'  # Apply appropriate patch level checks per vendor
  condition: selection and not filter_patched
falsepositives:
  - Systems with backported security patches not reflected in version number
level: informational

// Hunt for suspicious privilege escalation patterns potentially indicating CVE-2026-31635 exploitation
// Adjust table names based on your Syslog/CEF ingestion schema
Syslog
| where ProcessName in ("bash", "sh", "zsh", "dash")
| extend ProcessUser = tostring(ProcessInformation)
| where SyslogMessage has "uid=0(" or SyslogMessage contains "root"
| project TimeGenerated, Computer, ProcessName, ProcessUser, SyslogMessage
| where not(ProcessUser has @"sshd" or ProcessUser has @"sudo" or ProcessUser has @"systemd")
| order by TimeGenerated desc
| extend HuntingContext = "Potential kernel LPE via DirtyDecrypt - Non-privileged user spawning root shell"

// Alternative hunt for suspicious execution from temp directories
Syslog
| where SyslogMessage has @"/tmp/" or SyslogMessage has @"/var/tmp/" or SyslogMessage has @"/dev/shm/"
| where SyslogMessage has "execve"
| project TimeGenerated, Computer, SyslogMessage
| where not(SyslogMessage has @"vendor" or SyslogMessage has @"package")
| order by TimeGenerated desc
| extend HuntingContext = "Potential exploit staging - Execution from temporary directory"

-- Hunt for evidence of DirtyDecrypt exploitation or suspicious privilege escalation
-- Look for root shells spawned from non-parent processes
SELECT Pid, Ppid, Name, Username, Exe, CommandLine, Ctime
FROM pslist()
WHERE Username = 'root'
  AND Name IN ('bash', 'sh', 'zsh', 'dash')
  AND Ppid NOT IN (
    SELECT Pid FROM pslist() 
    WHERE Name IN ('sshd', 'sudo', 'su', 'systemd', 'cron')
  )

-- Scan for suspicious files in temporary directories that may be exploit artifacts
SELECT FullPath, Size, Mtime, Atime, Mode, Username
FROM glob(globs="/**/tmp/*", root="/")
WHERE Mode =~ '^.*x.*$'
  AND Size < 1048576
  AND NOT Name =~ '^\.'
LIMIT 100

-- Check for vulnerable kernel version
SELECT OS, KernelVersion, Release, Architecture
FROM info()
WHERE KernelVersion =~ '^(5\.15|6\.1|6\.5)'
  AND NOT KernelVersion =~ '\.1.*'  -- Adjust based on vendor patch info

#!/bin/bash
# CVE-2026-31635 (DirtyDecrypt) - Linux Kernel LPE Remediation Script
# This script checks for vulnerable kernel versions and provides remediation guidance

echo "=== CVE-2026-31635 (DirtyDecrypt) Remediation Check ==="
echo "Run date: $(date)"
echo ""

# Check current kernel version
CURRENT_KERNEL=$(uname -r)
echo "Current kernel version: $CURRENT_KERNEL"

# Determine distribution
echo ""
echo "Detecting Linux distribution..."
if [ -f /etc/os-release ]; then
    . /etc/os-release
    DISTRO=$ID
    echo "Distribution: $PRETTY_NAME"
else
    echo "WARNING: Cannot determine distribution. Manual verification required."
    exit 1
fi

# Check for known vulnerable kernel patterns (adjust based on vendor advisories)
echo ""
echo "Checking for vulnerable kernel versions..."
VULNERABLE=false

# Red Hat / CentOS / RHEL patterns
if [[ "$DISTRO" =~ ^(rhel|centos|rocky|almalinux) ]]; then
    if [[ "$CURRENT_KERNEL" =~ ^3\.10\.0- ]] || [[ "$CURRENT_KERNEL" =~ ^4\.18\.0- ]] || [[ "$CURRENT_KERNEL" =~ ^5\.14\.0- ]]; then
        VULNERABLE=true
        echo "WARNING: Potentially vulnerable RHEL-based kernel detected."
        echo "Refer to RHSA-2026:XXXXX for patch details."
    fi

# Debian / Ubuntu patterns
elif [[ "$DISTRO" =~ ^(debian|ubuntu) ]]; then
    if [[ "$CURRENT_KERNEL" =~ ^5\.15\.0- ]] || [[ "$CURRENT_KERNEL" =~ ^6\.1\.0- ]] || [[ "$CURRENT_KERNEL" =~ ^6\.5\.0- ]]; then
        VULNERABLE=true
        echo "WARNING: Potentially vulnerable Debian/Ubuntu kernel detected."
        echo "Refer to DSA-XXXX-X or USN-XXXX-X for patch details."
    fi

# Generic check for other distributions
else
    if [[ "$CURRENT_KERNEL" =~ ^(5\.15|6\.1|6\.5) ]]; then
        VULNERABLE=true
        echo "WARNING: Potentially vulnerable kernel version detected."
        echo "Verify against your distribution's security advisories."
    fi
fi

if [ "$VULNERABLE" = false ]; then
    echo "No known vulnerable pattern detected, but verify with vendor advisories."
fi

echo ""
echo "=== Remediation Steps ==="
echo "1. Update to the latest patched kernel for your distribution"
echo "   - RHEL/CentOS: yum update kernel"
echo "   - Debian/Ubuntu: apt-get update && apt-get install linux-image-generic"
echo "   - SUSE: zypper update kernel-default"
echo ""
echo "2. Reboot the system to load the new kernel: reboot"
echo ""
echo "3. Verify the update post-reboot by running this script again"
echo ""
echo "4. If immediate reboot is not possible, restrict local user access"
echo "   as a temporary mitigation while scheduling maintenance."
echo ""
echo "For official advisories:"
echo "- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-31635"
echo "- Your distribution's security announcement page"