sbeteta42/cve-2026-31431_je_sappelle_rootCVE-2026-31431 - Guide de Remédiation et Mesures de Protection
This repository documents the CVE-2026-31431 vulnerability, nicknamed Copy Fail, and provides a defensive remediation procedure for potentially exposed Linux systems.
⚠️ This repository is strictly focused on defense, authorized auditing, hardening, and remediation.
It does not provide an exploitation procedure and must not be used to compromise third-party systems.
CVE-2026-31431 / Copy Fail is a local privilege escalation vulnerability in the Linux kernel.
It affects the kernel's cryptographic subsystem, more specifically the AF_ALG user interface and the algif_aead module. The flaw is related to an optimization introduced in 2017 in the Linux kernel's AEAD path. Under certain conditions, an unprivileged local user can trigger a controlled write into the of a readable file, notably a setuid binary, which can lead to privilege escalation to .
rootThe vulnerability is rated High with a CVSS v3.1 score of 7.8.
| Element | Detail |
|---|---|
| CVE | CVE-2026-31431 |
| Public name | Copy Fail |
| Type | Local Privilege Escalation, LPE |
| Component | Linux kernel crypto subsystem |
| Affected module | algif_aead |
| Interface | AF_ALG |
| Mechanism involved | AEAD, authencesn, splice(), page cache |
| CVSS v3.1 score | 7.8 High |
| Privileges required | Unprivileged local account |
| User interaction | None |
| Impact | High confidentiality, integrity, and availability |
Public sources indicate that Linux distributions shipping a kernel derived from a vulnerable branch since the 2017 optimization may be exposed.
Examples of platforms mentioned in public publications:
| Distribution | Example of publicly tested kernel version |
|---|---|
| Ubuntu 24.04 LTS | 6.17.0-1007-aws |
| Amazon Linux 2023 | 6.18.8-9.213.amzn2023 |
| RHEL 10.1 | 6.12.0-124.45.1.el10_1 |
| SUSE 16 | 6.12.0-160000.9-default |
| Debian | Depending on kernel version and security status |
| AlmaLinux / Rocky Linux / Oracle Linux | Depending on kernel version and vendor backports |
The exact status depends on the kernel version, vendor, security backports, and already applied patches.
This vulnerability is particularly dangerous in environments where untrusted users or workloads have access to a local shell or a shared execution environment.
Environments to prioritize:
Main risk:
root;uname -a
uname -r
lsmod | grep algif_aead || true
sudo lsof -nP | grep AF_ALG || true
dpkg -l | grep -E '^ii\\s+linux-image|^ii\\s+linux-modules'
rpm -qa | grep -E '^kernel|^kernel-core'
rpm -qa | grep -E '^kernel'
Priority option: apply the vendor kernel patch The proper remediation is to install a patched kernel provided by the distribution, then reboot onto that kernel.
sudo apt update
sudo apt full-upgrade -y
sudo reboot
sudo dnf update -y kernel kernel-core kernel-modules
sudo reboot
sudo zypper refresh
sudo zypper patch
sudo reboot
# After reboot:
uname -r
If no patched kernel is yet available or if an immediate reboot is impossible, apply a temporary mitigation.
echo "install algif_aead /bin/false" | sudo tee /etc/modprobe.d/disable-algif-aead.conf
sudo modprobe -r algif_aead 2>/dev/null || true
sudo rmmod algif_aead 2>/dev/null || true
sudo update-initramfs -u
sudo dracut -f
sudo mkinitrd
sudo reboot
sudo modprobe algif_aead
echo $?
On some kernels, the module may be compiled directly into the kernel and cannot be loaded/unloaded as a module.
grep CONFIG_CRYPTO_USER_API_AEAD /boot/config-$(uname -r)
CONFIG_CRYPTO_USER_API_AEAD=m
The component is a module. The mitigation via /etc/modprobe.d/ is applicable.
CONFIG_CRYPTO_USER_API_AEAD=y
The component is built into the kernel. The modprobe.d mitigation is not sufficient.
In this case, preferably use:
Some sources mention the following kernel option as a possible workaround:
initcall_blacklist=algif_aead_init
Must be tested outside production before general deployment. This option may vary depending on the kernel, distribution, and boot configuration.
For Docker, Podman, Kubernetes, and CI/CD, the ability for untrusted workloads to open AF_ALG sockets must be reduced.
sudo lsof -nP | grep AF_ALG || true
lsmod | grep algif_aead || true
find / -perm -4000 -type f 2>/dev/null
sudo ausearch -f /usr/bin/su 2>/dev/null || true
sudo auditctl -w /usr/bin/su -p x -k su_exec_monitoring
sudo ausearch -k su_exec_monitoring
last -a
lastlog
getent passwd
sudo find /etc/cron* -type f -ls 2>/dev/null
sudo find /root /home -name authorized_keys -type f -ls 2>/dev/null
sudo journalctl --since "48 hours ago"
#!/usr/bin/env bash
set -euo pipefail
echo "[+] CVE-2026-31431 - temporary algif_aead mitigation"
if [[ $EUID -ne 0 ]]; then
echo "[-] This script must be run as root."
exit 1
fi
echo "[+] Active kernel version: $(uname -r)"
echo "[+] Persistent disabling of algif_aead loading"
echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif-aead.conf
echo "[+] Attempting to unload the module"
modprobe -r algif_aead 2>/dev/null || true
rmmod algif_aead 2>/dev/null || true
if command -v update-initramfs >/dev/null 2>&1; then
echo "[+] Updating initramfs Debian/Ubuntu"
update-initramfs -u
elif command -v dracut >/dev/null 2>&1; then
echo "[+] Updating initramfs via dracut"
dracut -f
elif command -v mkinitrd >/dev/null 2>&1; then
echo "[+] Updating initramfs via mkinitrd"
mkinitrd
else
echo "[!] No known initramfs tool detected. Verify manually."
fi
echo "[+] Verification"
lsmod | grep algif_aead && echo "[!] Module still loaded" || echo "[OK] Module not loaded"
echo "[+] Reboot recommended."
It does not replace:
installing a patched kernel;
rebooting onto the patched kernel;
validating the vendor status;
post-incident analysis if a compromise is suspected.
It may also affect certain software explicitly configured to use the AF_ALG cryptographic interface.
Theori / Xint Code — Copy Fail Technical Write-up https://xint.io/blog/copy-fail-linux-distributions Theori GitHub PoC repository https://github.com/theori-io/copy-fail-CVE-2026-31431 NVD — CVE-2026-31431 https://nvd.nist.gov/vuln/detail/CVE-2026-31431 CERT-EU — Security Advisory 2026-005 https://cert.europa.eu/publications/security-advisories/2026-005/ Ubuntu Security — CVE-2026-31431 https://ubuntu.com/security/CVE-2026-31431 Debian Security Tracker — CVE-2026-31431 https://security-tracker.debian.org/tracker/CVE-2026-31431 SUSE CVE Tracker — CVE-2026-31431 https://www.suse.com/security/cve/CVE-2026-31431.html Tenable FAQ — Copy Fail https://www.tenable.com/blog/copy-fail-cve-2026-31431-frequently-asked-questions-about-linux-kernel-privilege-escalation
This repository is provided solely for the following purposes:
Any unauthorized offensive use is illegal and contrary to the purpose of this repository.