CVE-2026-31431 — Copy Fail

Local Privilege Escalation in the Linux kernel's authencesn cryptographic template via AF_ALG + splice().
Disclosed April 29, 2026 by Theori (Xint Code).

Overview

Vulnerability Summary

A logic flaw in the kernel's authencesn AEAD wrapper allows an unprivileged local user to perform a deterministic, controlled 4-byte write into the page cache of any readable file on the system — including setuid binaries such as /usr/bin/su.

The root cause is a 2017 in-place processing optimization that placed page cache pages into a writable scatterlist. The authencesn algorithm writes 4 bytes of scratch data outside its intended output region during Extended Sequence Number rearrangement. Because of the scatterlist structure introduced by the optimization, those 4 bytes land in the page cache of a file fed via splice() — bypassing file permissions entirely.

No race condition. No retries. No crash risk. Deterministic across all tested distributions.

Comparison to Prior Art

Affected Versions

Vulnerable: Linux kernel 4.14 through 6.18.21 and 6.19.x before 6.19.12.

All major distributions shipping kernels in this range are affected, including:

Not affected: Ubuntu 26.04 (Resolute) and later.

Mitigation

Option 1 — Patch (Recommended)

Update to a kernel containing mainline commit a664bf3d603d, which reverts the 2017 in-place optimization.

# Ubuntu / Debian
sudo apt update && sudo apt upgrade -y && sudo reboot

# RHEL / AlmaLinux / Amazon Linux
sudo dnf clean metadata && sudo dnf upgrade && sudo reboot

# SUSE
sudo zypper refresh && sudo zypper update kernel-default && sudo reboot

Option 2 — Disable algif_aead (Temporary)

If patching immediately is not possible, disable the vulnerable module to close the attack surface.

Note for RHEL-family systems: algif_aead is built into the kernel on RHEL/AlmaLinux/CentOS (CONFIG_CRYPTO_USER_API_AEAD=y). The modprobe.d workaround does not work on these systems. Use the initcall_blacklist method instead.

Debian/Ubuntu (module is loadable):

echo "install algif_aead /bin/false" | sudo tee /etc/modprobe.d/disable-algif.conf
sudo rmmod algif_aead 2>/dev/null || true

RHEL-family (built-in kernel — requires reboot):

sudo grubby --update-kernel=ALL --args="initcall_blacklist=algif_aead_init"
sudo reboot

Confirm after reboot:

grep initcall_blacklist /proc/cmdline

What This Workaround Affects

Option 3 — seccomp (Defense-in-Depth)

For untrusted workloads — containers, CI runners, sandboxed environments — block AF_ALG socket creation via seccomp policy regardless of patch state. This limits the attack surface even on vulnerable kernels.

Detection

Check if algif_aead is currently loaded or in use:

# Check if module is loaded
lsmod | grep algif_aead

# Check if any process has an AF_ALG socket open
lsof | grep AF_ALG
ss -xa | grep alg

Runtime detection signatures are available in Sysdig Secure (rule: AF_ALG Page Cache Poisoning Leading to Privilege Escalation).

References

Disclosure Timeline

Author

xD The Watcher — Red Teamer, Ethical Hacker & AI Security Researcher
GitHub: @xd20111
Blog: yourhacker

Notes

This repository documents the vulnerability for research and defensive purposes. For the authoritative technical writeup and official PoC, refer to Theori's disclosure linked above.

If your threat model includes shared-kernel multi-tenancy — containers on a shared host, CI runners, build farms — the isolation boundary is now meaningfully weaker until patched. Hardware or VM-level isolation is the correct response, not namespace boundaries.