0xblackash/cve-2026-31431CVE-2026-31431
A surprisingly simple yet deadly local privilege escalation in the Linux kernel
CVE-2026-31431 (nicknamed "Copy Fail") is a local privilege escalation vulnerability in the Linux kernel's cryptographic subsystem, specifically affecting the algif_aead interface.
An unprivileged local user can exploit this flaw to perform a controlled 4-byte write into the page cache of any readable file on the system — including setuid binaries — ultimately allowing arbitrary code execution as root.
The vulnerability was introduced in 2017 by commit 72548b093ee3 ("crypto: algif_aead - support in-place operations").
The kernel incorrectly assumed that AEAD requests could safely run in-place (req->src == req->dst). However, when using AF_ALG sockets with splice() from regular files, the source and destination buffers often reside in different memory mappings.
This mismatch led to a logic error allowing controlled memory corruption in the page cache.
Exploitation is trivial. A ~10-line Python PoC can reliably gain root on unpatched systems.
| Metric | Value |
|---|---|
| CVSS v3 Score | 7.8 (High) |
| Red Hat Rating | Important |
a664bf3 (or equivalent backports)Recommended Action: Update your kernel immediately.
The official fix reverts the problematic in-place optimization in crypto/algif_aead.c.
# Ubuntu / Debian
sudo apt update && sudo apt upgrade -y
# RHEL / Fedora / Rocky / Alma
sudo dnf update kernel -y
# Check kernel version
uname -r
Temporary Workaround (if immediate patching isn't possible):
AF_ALG socket usage via seccomp or AppArmor/SELinuxPublic exploits are already available, including a very small and reliable Python proof-of-concept.
⚠️ Warning: Systems left unpatched after disclosure are highly vulnerable.
Stay safe. Patch early. Patch often.
Made with ❤️ for the Linux community
| Ubuntu Rating | High |
| Attack Type | Local Privilege Escalation |