CVE-2026-31431-Copy-Fail-add-arm64

Vulnerability Overview

Vulnerability Details

In 2017, the kernel introduced an in-place encryption optimization in the algif_aead crypto module. This optimization caused page-cache pages to be incorrectly placed into a writable destination scatterlist. By combining the AF_ALG socket with the splice() system call, an attacker can write data to the page cache of arbitrary files, including root-owned read-only files.

Attack Chain: AF_ALG socket → splice() → page-cache write primitive → tamper with setuid binary page cache → execute the file to gain root privileges

Attack Characteristics:

• No race condition (not a race condition, but a direct logic flaw)
• No kernel debugging features required
• No architecture-specific offset adaptation required
• Universal exploit script is only ~732 bytes and works across all major distributions

Affected Scope

Verified Affected Distributions

Distributions such as Debian, Arch, Fedora, Rocky, Alma, and Oracle with the same kernel range are also affected.

Affected Kernel Version Range

All kernel versions below the following fixed versions are affected:

Detection Methods

1. Check Kernel Version

uname -r

Compare the output with the fixed versions in the table above. If the version is lower than the fixed version, the system is affected.

2. Check AF_ALG Connections

# Check for current AF_ALG connections
lsof | grep AF_ALG

# Check AF_ALG socket status
ss -xa | grep alg

3. Check Whether the algif_aead Module Is Loaded

lsmod | grep algif_aead

If there is output, the module is loaded and the system is at risk of exploitation.

4. Vulnerability Verification (Authorized Test Environments Only)

# Clone the PoC repository
git clone https://github.com/cx330zer0/CVE-2026-31431-Copy-Fail-add-arm64.git
cd CVE-2026-31431-Copy-Fail-add-arm64

# Run the PoC (requires non-privileged user identity)
python3 copy-fail-dual-arch.py

If the PoC successfully obtains a root shell, the system is vulnerable to this flaw.