Copy Fail Linux Kernel Flaw Enables Local Privilege Escalation to Root
Summary
CVE-2026-31431 lets unprivileged local users exploit a Linux kernel flaw to gain root and, in some scenarios, escape containers. Upstream has fixed it, but distribution patches remain uneven; teams should prioritize updates and mitigations.
Key points
- The flaw affects Linux kernel versions built from 2017 until the fix and allows a local unprivileged user to alter four controlled bytes in the page cache of a readable file.
- The exploit chains a flaw in algif_aead with AF_ALG sockets and splice(), potentially modifying privileged binaries such as /usr/bin/su at runtime.
- Container escape may be possible when an unprivileged container shares a base image with a privileged container on the same node.
- A fix is available upstream, but distribution patching was incomplete as of May 1, 2026; teams should check their distribution's status and update to a fixed kernel.
- Temporary mitigations include disabling the algif_aead module or blocking AF_ALG socket creation with seccomp; effectiveness varies by distribution.
- Prioritize affected hosts that run untrusted code, including multi-tenant services and public-repository CI runners.
- Possible detection signals include suspicious AF_ALG activity, unexpected delayed module loading, use of curl to hxxps://copy[.]fail/exp, and malformed su log entries; these indicators are incomplete and should be correlated.
Article Details
- Vulnerability Types
- Linux kernel logic flaw in AEAD crypto implementation (algif_aead)
- Out-of-bounds write
- Local privilege escalation
- Container escape
- Affected Versions
- Linux kernel versions built between 2017 and the 2026 patch release
- Exploitation Status
- reported
- Exploit Availability
- public_poc
- Patch Status
- partial
- Workarounds
- Disable the vulnerable algif_aead module.
- Block AF_ALG socket creation via seccomp policies.
MITRE ATT&CK
T1068 · Exploitation for Privilege EscalationThe vulnerability allows an unprivileged local user to gain root privileges by modifying the page cache of a readable file.T1611 · Escape to HostIn the described scenario, an attacker in an unprivileged container can override binaries in a shared base image and escape to the host through a privileged container.
CVE
People
Vendors
Amazon LinuxAmazon Linux Patching in progress Kernel updates rolling outArch LinuxArch Linux Likely patched Rolling release tracks upstream closelyCloudLinuxCloudLinux Not patched Patch not yet releasedDebianDebian (sid / unstable) Patched Fix available in latest kernel packagesFedoraFedora Patching in progress Newer kernels likely include fixRHELRHEL (8 / 9) Patching in progress Gradual rollout of backported fixesSUSESUSE / SLES Patching in progress Updates depend on service packUbuntuUbuntu Not patched (mostly) No broadly released fixed kernels; LTS versions remain vulnerable