kwilck/copyfailCopy Fail (CVE-2026-31431) is a logic flaw in the Linux kernel's algif_aead module — part of the AF_ALG userspace crypto API. It was disclosed on April 29, 2026 by Theori / Xint Code.
A read-only detection script for the Copy Fail Linux kernel local privilege escalation vulnerability.
No exploit code. No AF_ALG socket opened. No files written outside/etc/modprobe.d(only when you apply the mitigation manually).
Copy Fail (CVE-2026-31431) is a logic flaw in the Linux kernel's algif_aead module — part of the AF_ALG userspace crypto API. It was disclosed on April 29, 2026 by Theori / Xint Code.
A 732-byte Python script can give an unprivileged local user full root access on virtually every major Linux distribution built since 2017 — without race conditions, kernel offsets, or compiled payloads.
| Property | Detail |
|---|---|
| CVE | CVE-2026-31431 |
| CVSS | 7.8 HIGH |
| Type | Local Privilege Escalation (LPE) |
| Affected kernels | 4.14 – 6.18.21, 6.19.0 – 6.19.11 |
| Root cause | algif_aead in-place optimization (commit 72548b093ee3, 2017) |
| Upstream fix | Revert via commit a664bf3d603d |
| Exploit reliability | Deterministic — no race condition required |
modprobe.d blacklist, initcall_blacklist kernel cmdline paramkmod package version per USN-8226-1Note on Ubuntu / Debian: Ubuntu does not bump the upstream kernel version when backporting security patches. The script therefore checks the
kmodpackage version (>= 31+20240202-2ubuntu7.2per USN-8226-1) rather than relying on the kernel version string alone.
# Download
curl -O https://raw.githubusercontent.com/kw-soft/copyfail/main/copyfail.sh
# Make executable
chmod +x copyfail.sh
# Run (root recommended for full module visibility)
sudo ./copyfail.sh
============================================
CVE-2026-31431 'Copy Fail' — Safe Detection
============================================
[*] Kernel: 6.8.0-71-generic
[!] Kernel 6.8.0-71-generic is in the vulnerable upstream range (4.14 – 6.19.11)
[~] Distro backport check follows — version number alone is not conclusive
[*] algif_aead module status:
[!] algif_aead is LOADED — attack surface is active
[*] Distribution patch status:
Distro : Ubuntu 24.04
kmod installed : 31+20240202-2ubuntu6
kmod required : >= 31+20240202-2ubuntu7.2
[!] kmod 31+20240202-2ubuntu6 < 31+20240202-2ubuntu7.2 — mitigation NOT applied
============================================
RESULT
============================================
[!] VULNERABLE — kernel affected and algif_aead is active
============================================
CVE-2026-31431 'Copy Fail' — Safe Detection
============================================
[*] Kernel: 6.8.0-71-generic
[!] Kernel 6.8.0-71-generic is in the vulnerable upstream range (4.14 – 6.19.11)
[~] Distro backport check follows — version number alone is not conclusive
[*] algif_aead module status:
[✓] algif_aead is NOT loaded
[✓] modprobe blacklist active: /etc/modprobe.d/disable-algif_aead.conf
[*] Distribution patch status:
Distro : Ubuntu 24.04
kmod installed : 31+20240202-2ubuntu7.2
kmod required : >= 31+20240202-2ubuntu7.2
[✓] kmod >= 31+20240202-2ubuntu7.2 — USN-8226-1 mitigation present
============================================
RESULT
============================================
[✓] MITIGATED — algif_aead is blocked
[~] Apply a patched kernel when available to fully resolve the issue
sudo apt update && sudo apt upgrade && sudo reboot
This installs the patched kmod package (USN-8226-1) which drops a modprobe.d rule blocking algif_aead.
If an immediate reboot is not possible:
echo 'install algif_aead /bin/false' | sudo tee /etc/modprobe.d/disable-algif.conf
sudo update-initramfs -u
sudo rmmod algif_aead 2>/dev/null || echo "Module in use — reboot required"
⚠️ On RHEL-family kernels,
algif_aeadis built into the kernel (CONFIG_CRYPTO_USER_API_AEAD=y).
modprobe.drules have no effect. Use the grub parameter instead:
sudo grubby --update-kernel=ALL --args='initcall_blacklist=algif_aead_init'
sudo reboot
sudo pacman -Syu linux && sudo reboot
The mitigation does not impact any of the following:
dm-crypt / LUKS full-disk encryptionOnly applications explicitly configured to use the afalg engine or that bind AF_ALG AEAD sockets directly may be affected — this is rare in standard deployments.
Hetzner does not apply OS updates automatically. Ubuntu ships unattended-upgrades pre-installed, but it must be enabled and configured.
# Check if automatic security updates are active
cat /etc/apt/apt.conf.d/20auto-upgrades
# View upgrade history
grep "^Start-Date\|^Commandline" /var/log/apt/history.log | tail -30
# Check if the kmod mitigation was applied automatically
grep "kmod\|algif" /var/log/apt/history.log
# Check last unattended-upgrades run
tail -30 /var/log/unattended-upgrades/unattended-upgrades.log
Note: Even with
unattended-upgradesenabled, automatic reboots are off by default.
A new kernel only becomes active after a manualreboot.
This script is intended for use on systems you own or are authorized to test.
It performs read-only checks and does not exploit the vulnerability in any way.
| Distribution | Check method |
|---|
| Ubuntu / Linux Mint | kmod package version (USN-8226-1) |
| Debian | kmod package version + security tracker |
| Parrot OS | kmod package version (Debian rolling) |
| RHEL / CentOS / AlmaLinux / Rocky | dnf updateinfo + initcall_blacklist cmdline |
| Fedora | dnf updateinfo |
| Amazon Linux | dnf check-update --security |
| SUSE / openSUSE | zypper lp |
| Arch Linux | pacman -Syu linux |
| Resource | Link |
|---|