Copy Fail Linux Flaw Enables Local Privilege Escalation Through AF_ALG and splice()

Summary

Copy Fail (CVE-2026-31431) is described as a Linux local privilege-escalation flaw abusing AF_ALG and splice() to alter a SUID binary in page cache. The article gives detection guidance and mitigations; it reports no confirmed real-world attacks.

Key points

The article describes Copy Fail (CVE-2026-31431) as a Linux local privilege-escalation vulnerability affecting kernels released since 2017, with a CVSS 3.1 score of 7.8.
The exploit combines the AF_ALG crypto interface and splice() to modify the page-cache copy of a SUID binary while leaving the on-disk file unchanged, potentially enabling root execution.
The article says a public proof of concept is available and reports no confirmed real-world attacks as of publication.
Suggested detection signals include AF_ALG socket creation, repeated splice() calls, and SUID binary execution with elevated privileges.
The article provides auditd and Sysmon detection examples, as well as kernel-log patterns for investigating possible exploitation.
Kernel patching is presented as the most reliable fix. Temporary options include restricting AF_ALG or disabling affected modules, which may affect legitimate cryptographic functionality.

Article Details

Vulnerability Types: Local privilege escalation
Severity: CVSS 3.1: 7.8 (High)
Exploitation Status: not_reported
Exploit Availability: public_poc
Patch Status: available
Workarounds: Restrict AF_ALG socket creation through seccomp.
Disable the algif_aead module with modprobe; if the vulnerable code is built into the kernel, use initcall_blacklist for algif_aead_init or af_alg_init.