CVE-2026-31431 Vulnerability Overview

CVE ID：CVE-2026-31431
Alias：Copy Fail
Severity：High (CVSS v3 Score 7.8)
Vulnerability Type：Local Privilege Escalation (LPE)
Affected Component：The algif_aead module (AF_ALG cryptographic interface) of the Linux kernel
Prerequisites：The attacker only needs a normal user execution privilege on the target system (even inside a restricted container), without any special capabilities or user interaction.

Affected Scope

• Red Hat family：Red Hat Enterprise Linux 8/9/10, CentOS, AlmaLinux, Rocky Linux, etc.
• Debian family：Ubuntu 20.04/22.04/24.04 LTS, etc. (Note: Ubuntu 26.04 and later are not affected)
• Other distributions：SUSE Linux Enterprise 16, Amazon Linux 2023, Fedora, Arch Linux, etc.

Vulnerability Reproduction

Check if the service is enabled

lsmod | grep algif_aead

If not enabled, manually enable the service

sudo modprobe algif_aead

Reproduction Environment 1

Environment：Linux song 6.8.0-110-generic #110~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Fri Mar 27 12:43:08 UTC x86_64 x86_64 x86_64 GNU/Linux

Reproduction Environment 2

Environment：Linux ubuntu-linux-2404 6.8.0-110-generic #110-Ubuntu SMP PREEMPT_DYNAMIC Thu Mar 19 17:16:23 UTC 2026 aarch64 aarch64 aarch64 GNU/Linux