CVE-2026-31431 — Copy Fail

中文版

732 Bytes to Root on Every Major Linux Distribution

CVE-2026-31431 (Copy Fail) is a logic bug in the Linux kernel's authencesn cryptographic template. It allows an unprivileged local user to trigger a deterministic, controlled 4-byte write into the page cache of any readable file on the system.

Overview

• CVE ID: CVE-2026-31431
• Type: Local Privilege Escalation / Container Escape
• Affected: Linux kernels with CONFIG_CRYPTO_AUTHENC (essentially all major distros since 2017)
• Discovered by: Xint Code Research Team, with initial insight from Theori researcher Taeyang Lee

How It Works

The bug chains two behaviors:

1. AF_ALG + splice: splice() transfers page cache pages by reference into an AF_ALG socket's scatterlist. For AEAD decryption in-place mode, the tag pages (from the target file's page cache) remain chained to the output scatterlist via sg_chain().

2. authencesn scratch write: crypto_authenc_esn_decrypt() uses dst[assoclen + cryptlen] (past the tag, into the page cache pages) as scratch space for ESN sequence number rearrangement, writing 4 attacker-controlled bytes and never restoring them.

The corrupted page is never marked dirty, so the on-disk file remains unchanged. But the in-memory page cache is what actually gets read — making the corruption immediately visible system-wide.

Exploit

The exploit corrupts the page cache of /usr/bin/su (or any setuid binary) with a small shellcode payload, 4 bytes at a time. After all iterations, running su executes the payload and drops to a root shell.

Python (exp.py)

python3 exp.py

Golang (exp.go)

go run exp.go
go build -ldflags "-w -s" -trimpath -o exp exp.go

tinygo build -o exp exp.go

Impact

References

• copy.fail — Official Advisory
• Xint Blog — Copy Fail: 732 Bytes to Root
• NVD Entry
• rewrite by C

Disclaimer

This repository is published for educational and defensive research purposes only. Do not use this code on systems you do not own or have explicit permission to test.