CVE-2026-31431 — Copy Fail

中文版

732 Bytes to Root on Every Major Linux Distribution

CVE-2026-31431 (Copy Fail) is a logic bug in the Linux kernel's authencesn cryptographic template. It allows an unprivileged local user to trigger a deterministic, controlled 4-byte write into the page cache of any readable file on the system.

Overview

• CVE ID: CVE-2026-31431
• Type: Local Privilege Escalation / Container Escape
• Affected: Linux kernels with CONFIG_CRYPTO_AUTHENC (essentially all major distros since 2017)
• Discovered by: Xint Code Research Team, with initial insight from Theori researcher Taeyang Lee

How It Works

The bug chains two behaviors:

1. AF_ALG + splice: splice() transfers page cache pages by reference into an AF_ALG socket's scatterlist. For AEAD decryption in-place mode, the tag pages (from the target file's page cache) remain chained to the output scatterlist via sg_chain().

2. authencesn scratch write: crypto_authenc_esn_decrypt() uses dst[assoclen + cryptlen] (past the tag, into the page cache pages) as scratch space for ESN sequence number rearrangement, writing 4 attacker-controlled bytes and never restoring them.

The corrupted page is never marked dirty, so the on-disk file remains unchanged. But the in-memory page cache is what actually gets read — making the corruption immediately visible system-wide.

Exploit

The exploit corrupts the page cache of /usr/bin/su (or any setuid binary) with a small shellcode payload, 4 bytes at a time. After all iterations, running su executes the payload and drops to a root shell.

Python (exp.py)

python3 exp.py

C (exp.c)

gcc -o exp exp.c
./exp

Impact

References

• copy.fail — Official Advisory
• Xint Blog — Copy Fail: 732 Bytes to Root
• NVD Entry

Disclaimer

This repository is published for educational and defensive research purposes only. Do not use this code on systems you do not own or have explicit permission to test.