grabesec/xcp_ng_cve-2026-31431_testerNon-destructive detector for CVE-2026-31431 (Copy Fail) local privilege escalation in XCP-ng 8.3 Dom0, validating kernel vulnerability via page-cache corruption test.
A safe, non-destructive detector script for CVE-2026-31431 ("Copy Fail"), validated against XCP-ng 8.3 LTS prior to the May 5, 2026 security update.
⚠️ Authorized use only. Run this script exclusively on systems you own or are explicitly authorized to test.
CVE-2026-31431, dubbed "Copy Fail", is a local privilege escalation (LPE) vulnerability in the Linux kernel's algif_aead cryptographic interface. A logic flaw in the authencesn template — introduced in 2017 — allows an unprivileged local user to perform a controlled 4-byte write into the kernel's page cache of any readable file, enabling privilege escalation to root.
a664bf3d603d by Herbert XuXCP-ng's Dom0 control domain runs on a Linux kernel and is the hypervisor management layer. Any unprivileged user with shell access to Dom0 — including service accounts created for CI/CD pipelines, monitoring agents, backup tools, or automation — can exploit this vulnerability to gain root. From root in Dom0, all guest VMs on that host are compromised.
A default XCP-ng installation has minimal exposure as very few processes run as non-root users. The real risk accumulates over time as operators add service accounts for legitimate purposes without restricting shell access.
Audit your Dom0 service accounts:
awk -F: '$7 ~ /bash|sh/' /etc/passwd
This is a laboratory detector, not a privilege escalation tool. It:
algif_aead / authencesn page-cache scratch-write primitive against that fileSystem binaries, /etc/passwd, and other system files are never touched. Page cache corruption is in-memory only — nothing is written back to disk.
os.splice)python3 xcp_ng_cve_2026_31431_tester.py
| Code | Meaning |
|---|---|
0 | No corruption observed — system is likely patched or algif_aead is disabled |
1 | Trigger error — algif_aead may be unavailable or blocked |
2 | Vulnerable — page cache corruption confirmed |
Note: Exit code
1on a patched system is expected behavior, not a script error. Ifauthencesnhas been disabled at the kernel level (as in the XCP-ng May 5 fix), the socket bind will fail and the script will exit with code1.
| Date | Event |
|---|---|
| April 29, 2026 | CVE-2026-31431 publicly disclosed |
| May 4, 2026 | VATES publishes VSA-2026-013 |
| May 5, 2026 | XCP-ng 8.3 LTS May security update released — kernel fix available |
Update your XCP-ng hosts and reboot:
yum update
reboot
After reboot, verify the updated kernel is running:
uname -r
Re-run this detector script after patching. A patched system will return exit code 1 (trigger error) as the vulnerable authencesn template is no longer available.
Note: The XCP-ng fix disables IPSec ESN support as a consequence of removing the vulnerable
authencesncomponent. For most environments this has no practical impact. VATES has indicated a future patch may restore this functionality with a proper fix.
Before applying mitigations, confirm whether algif_aead is compiled as a module (=m) or built into the kernel (=y):
grep CONFIG_CRYPTO_USER_API_AEAD /boot/config-$(uname -r)
=m — Module-based; modprobe blacklist will work=y — Built into kernel; modprobe blacklist will silently fail and provide no protectionFor RHEL-family kernels with =y, use the grubby boot parameter instead:
grubby --update-kernel=ALL --args="initcall_blacklist=algif_aead_init"
reboot
This script is a modified derivative of rootsecdev's original work. Please verify the license of the upstream repository before redistribution and ensure your use complies with its terms.
This script was validated on XCP-ng 8.3 LTS running an unpatched kernel as of May 5, 2026. Apply the official VATES security update immediately if you have not done so.