CVE-2026-31431 "Copy Fail" — Vulnerability Detection Script

Shell-based scanner for CVE-2026-31431 "Copy Fail", a local privilege escalation vulnerability in the Linux kernel's cryptographic subsystem (algif_aead / AF_ALG interface). An unprivileged local user can write 4 bytes into the in-memory page cache of a setuid binary (e.g. /usr/bin/su) and obtain a root shell — without touching the on-disk file.

• CVSS: 7.8 (HIGH)
• Present in kernel since: 2017 (4.14)
• Upstream fix commit: a664bf3d603d
• CISA KEV: added 1 May 2026
• More info: copy.fail

Supported distributions

Ubuntu derivatives based on the above releases (Pop!_OS, Linux Mint, Elementary OS, etc.) are also detected via ID_LIKE in /etc/os-release.

What it checks

Usage

# Basic scan
bash cve-2026-31431-detect.sh

# No colour output (log files, CI)
bash cve-2026-31431-detect.sh --no-colour

# JSON output (machine-readable, for pipelines)
bash cve-2026-31431-detect.sh --json

# Quiet mode — only print the summary
bash cve-2026-31431-detect.sh --quiet

# Combine flags
bash cve-2026-31431-detect.sh --json --quiet

No root required. No packages to install beyond a standard shell (bash ≥ 4.3) and optionally python3 for the live AF_ALG socket test.

Exit codes

Designed for use in DevSecOps pipelines — pipe the JSON output to your SIEM, ticketing system, or compliance dashboard.

Output

The script prints results in two languages:

• English — full detailed summary with status, risk breakdown, and step-by-step remediation
• Hungarian (Magyar) — identical content in Hungarian

Both sections are printed to stdout after the per-check results.

Example (clean system)

=== Kernel Version ===
  [INFO] Distro flavour : ubuntu (id=ubuntu, codename=jammy, version=22.04)
  [INFO] Kernel release : 5.15.0-135-generic
  [OK] Kernel version
       Reason : Ubuntu jammy: kernel 5.15.0-135.145 >= patched version 5.15.0-135.145

...

  ✅ PROTECTED — SYSTEM IS NOT VULNERABLE

Example (vulnerable system)

  ❌ VULNERABLE — IMMEDIATE ACTION REQUIRED

  ✗ Kernel version
  ✗ Patch presence
  ✗ algif_aead module
  ✗ AF_ALG socket
  ✗ Setuid binaries

Remediation

Debian

sudo apt update && sudo apt full-upgrade && sudo reboot
# After reboot: uname -v  →  must show >= 6.1.170-1 (Bookworm)

Ubuntu

sudo apt update && sudo apt full-upgrade && sudo reboot
# After reboot: cat /proc/version_signature

Temporary mitigation (if kernel update is not immediately possible)

Only effective when CONFIG_CRYPTO_USER_API_AEAD=m (built as module). Has no effect if the option is compiled in (=y).

echo 'install algif_aead /bin/false' | sudo tee /etc/modprobe.d/disable-algif-aead.conf
sudo rmmod algif_aead 2>/dev/null || true

This does not affect SSH, dm-crypt/LUKS, OpenSSL, GnuTLS, NSS, web servers, or disk encryption.

Important notes

• This script does not execute any exploit code — configuration and version checks only.
• Copy Fail is local privilege escalation only — remote exploitation via the internet is not possible.
• The vulnerability modifies the in-memory page cache; on-disk files are never touched, so file-integrity tools (AIDE, Tripwire, etc.) will not detect an active attack.
• A reboot clears the page cache but the vulnerability remains — patching is the only permanent fix.
• Running the script as root may produce false negatives on the AF_ALG socket check (root can always open AF_ALG sockets).

References

• Debian Security Tracker: https://security-tracker.debian.org/tracker/CVE-2026-31431
• Ubuntu Security: https://ubuntu.com/security/CVE-2026-31431
• Ubuntu USN-7523-1: https://ubuntu.com/security/notices/USN-7523-1
• Upstream fix: https://github.com/torvalds/linux/commit/a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5
• Exploit details: https://copy.fail
• Original detection script: https://github.com/liamromanis101/CVE-2026-31431-Copy-Fail---Vulnerability-Detection-Script

License

MIT