VulnSocial
← Back to blog

CVE-2026-31431 – Critical Linux Kernel Local Privilege Escalation (Copy Fail)

Key Takeaways

  • Critical local privilege escalation (LPE) affecting Linux kernels released from 2017 onward.
  • Exploit is a 732‑byte Python script that works on the first try, no race condition required.
  • Impacts shared servers, container hosts, CI runners, and cloud sandboxes – any untrusted code can gain root.
  • Immediate patch required; fallback: disable the algif_aead module.
  • Monitor AF_ALG usage and page‑cache writes for early detection.

Overview

Security researchers at Theori disclosed CVE-2026-31431, nicknamed Copy Fail, a logic flaw in the Linux kernel’s cryptographic subsystem (module algif_aead). The bug was introduced in a 2017 optimization and has been present in every mainstream distribution that ships the kernel since then. An attacker with a regular user account can trigger the flaw to corrupt the in‑memory page cache of a set‑uid binary (e.g., /usr/bin/su), causing the next execution of that binary to run with root privileges.

Timeline

  • Mar 23 2026 – Vulnerability reported to the kernel security team.
  • Apr 1 2026 – Fix committed to mainline (commit a664bf3d603d).
  • Apr 22 2026 – CVE identifier assigned.
  • Apr 29 2026 – Public disclosure and PoC released.
  • Apr 29‑30 2026 – Multiple PoCs and exploit tools appear; active exploitation reported.

For live threat activity and detailed signal data, see the CVE page.

Technical Details

The vulnerability resides in the AF_ALG (kernel crypto API) implementation of the algif_aead algorithm. The exploit chain is:

  1. Open an AF_ALG socket and configure an AEAD cipher.
  2. Use splice() to direct encrypted output into the kernel’s page cache.
  3. Exploit a missing bounds check in the kernel’s handling of the splice buffer, allowing a 4‑byte write into the cached file image.
  4. Target a privileged binary (e.g., /usr/bin/su) that is cached in memory; the corrupted cache causes the binary to grant root on the next execution.

Because the write occurs only in the page cache, the on‑disk file remains unchanged, making forensic detection difficult. The exploit does not rely on timing windows, address leaks, or distribution‑specific offsets – it works on the first run on any kernel version that includes the vulnerable code.

Severity & Impact

MetricValue
SeverityCritical
CVSSN/A (high‑severity LPE)
ExploitabilityActive exploitation (multiple PoCs, exploit kits)
ImpactFull system compromise – root on host, container escape, CI runner takeover, tenant‑to‑host breach
AffectedLinux kernel 4.14 – 6.x (all major distros released 2017‑2026)

Affected Products

The flaw is in the Linux kernel itself, so any distribution that ships an affected kernel version is vulnerable. This includes, but is not limited to:

  • Ubuntu 18.04 LTS and later
  • Debian 10 and later
  • Red Hat Enterprise Linux 8 and later
  • SUSE Linux Enterprise Server 12 SP4 and later
  • Alpine Linux 3.12 and later

For the exhaustive list of affected kernel releases and version numbers, see the CVE page.

What Security Teams Should Do

  • Patch immediately – Deploy a kernel that includes commit a664bf3d603d.
  • Disable the vulnerable module if a patched kernel cannot be rolled out: create a modprobe blacklist (see Remediation).
  • Block the AF_ALG interface on hosts that run untrusted workloads (containers, CI runners, serverless functions).
  • Audit for AF_ALG usage – add an audit rule: auditctl -w /dev/crypto -p rwxa -k af_alg.
  • Detect page‑cache tampering – monitor kernel logs for “page cache” write errors and deploy YARA signatures (e.g., expl_copy_fail_cve_2026_31431.yar).
  • Harden container runtimes – drop CAP_SYS_ADMIN, remove /dev/crypto from the container namespace, and use a restrictive seccomp profile that denies socket(AF_ALG, …).
  • Monitor for the known PoC – the 732‑byte Python script has a distinctive string pattern; flag executions of short Python processes that import socket and os and call splice.

Remediation & Mitigation

  1. Apply the kernel patch

    • Ubuntu 22.04 LTS: kernel 5.15.0‑xxx‑generic or newer.
    • RHEL 8.9: kernel‑8.9.0‑xxx.el8 or newer.
    • Verify the fix is present: git log -p -S "algif_aead" $(uname -r) should show commit a664bf3d603d.

  2. Temporary mitigation – disable the module

    echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-alg.conf
rmmod algif_aead 2>/dev/null || true

    This prevents the vulnerable code path from being loaded.

  3. Restrict AF_ALG for untrusted workloads

    • Add a seccomp rule: SCMP_SYS(socket) arg0 == AF_ALG → SCMP_ACT_ERRNO(EPERM).
    • Remove /dev/crypto from container images and host mount namespaces.

  4. Deploy detection rules

    • YARA: import "pe"; rule copy_fail { strings: $p = "algif_aead" nocase; condition: $p }.
    • Auditd: auditctl -w /dev/crypto -p rwxa -k af_alg.

  5. Validate remediation – after patch or module disable, attempt the public PoC; it should fail with “operation not permitted”.

References

Bottom Line

CVE-2026-31431 is a Critical Linux kernel LPE that can be weaponized with a tiny Python script to gain root on any system running an affected kernel. The fix is already in mainline; organizations must patch now or disable the algif_aead module and harden their environments against AF_ALG usage. Continuous monitoring for the exploit pattern and restricting crypto interfaces in containerized workloads are essential to mitigate the risk.

#hashtags

#CVE #CVE202631431 #Critical #Linux #LPE #CopyFail #KernelBug