Skip to content

KEV: Linux kernel CopyFail AF_ALG local privilege escalation (CVE-2026-31431)

Signal: CISA added CVE-2026-31431 to KEV on 2026-05-01. Public writeups and PoC references describe CopyFail, a Linux kernel AF_ALG / algif_aead flaw that can give an unprivileged local attacker a controlled page-cache write primitive and possible root escalation.

What it is

The issue is in the kernel crypto API AEAD socket path. An in-place optimization in algif_aead let tag pages from a splice-backed send path be chained into the receive scatterlist. With the authencesn decrypt path, a failed decrypt could still write attacker-controlled bytes into those file-backed page-cache pages before authentication failure returned.

The practical result is narrower than “arbitrary kernel write,” but still severe: a local user may be able to corrupt cached pages for readable files, including setuid or privileged binaries, and turn that into local privilege escalation until the cache state is refreshed. CISA KEV means defenders should assume real-world exploitation pressure, not only theoretical risk.

References: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json, https://nvd.nist.gov/vuln/detail/CVE-2026-31431, https://www.openwall.com/lists/oss-security/2026/04/29/23, https://copy.fail/, https://github.com/theori-io/copy-fail-CVE-2026-31431

Affected / fixed scope

Kernel CVE notes say the bug was introduced in the long-lived 4.14 era by the AEAD in-place operation change and fixed by reverting that design in stable releases. Public references list fixes in stable branches including 6.18.22, 6.19.12, and 7.0, but distribution kernels backport patches: verify by vendor advisory and package build, not upstream version alone.

Triage

  1. Inventory Linux hosts where unprivileged shell, container breakout, shared hosting, CI runners, build workers, HPC users, or multi-tenant workloads make local privilege escalation high impact.
  2. Prioritize internet-facing hosts that also run untrusted code, customer workloads, browser automation, CI jobs, or sandboxed agent workloads.
  3. Check vendor advisories for whether the running kernel build includes the algif_aead out-of-place revert.
  4. Treat proof-of-concept testing as sensitive: run only in isolated lab systems you own, not production.

Mitigation

  • Patch to the vendor-fixed kernel and reboot into it. Confirm the active kernel after reboot (uname -a) rather than only package installation.
  • If immediate patching is blocked, consider disabling the vulnerable module path as a temporary containment control where your distribution supports it:
  • add a modprobe deny rule for algif_aead
  • unload algif_aead if currently loaded and no required workload depends on it
  • Reduce local attack surface while waiting for maintenance: pause untrusted jobs, restrict shell access, and isolate multi-tenant workloads.
  • For systems with suspicious local activity, preserve evidence before rebooting where practical, then review privilege escalation indicators after patching.

Hunt ideas

  • Look for unexpected setuid binary changes, package verification failures, or file-content mismatches that disappear after cache eviction / reboot.
  • Review local user command history, process accounting, EDR telemetry, and audit logs for AF_ALG / crypto socket activity near privilege transitions.
  • Inspect recent root shells, new sudoers entries, unexpected SSH keys, cron/systemd persistence, and modified privileged binaries.
  • On shared systems, correlate suspicious activity with local users or containers that had only low privileges before the event.

Durable lesson

Kernel copy paths that mix user-controlled scatterlists, splice-backed file pages, and in-place crypto operations need threat modeling as write primitives, not just performance plumbing. For operators, KEV-listed local privilege escalations should trigger the same urgency as remote bugs on any host that executes untrusted or semi-trusted local code.