Linux kernel vulnerability disclosed CVE-2026-31431

CVE-2026-31431, nicknamed “Copy Fail,” is a high-severity local privilege escalation (LPE) vulnerability in the Linux kernel disclosed on April 29, 2026.

The flaw allows an unprivileged local user to gain full root privileges in seconds. It is particularly dangerous because it is highly reliable, does not rely on race conditions, and affects nearly every major Linux distribution released since 2017.

---

🛠 Technical Overview

The vulnerability exists in the algif_aead module of the kernel’s cryptographic subsystem (AF_ALG).

• The Root Cause: A performance optimization introduced in 2017 (commit 72548b093ee3) allowed “in-place” cryptographic operations. Due to a logic flaw, the kernel improperly handles memory mappings when source and destination buffers overlap.

• The Primitive: An attacker can trigger a controlled 4-byte write into the kernel’s page cache.

• The Attack: By targeting the page cache of a privileged setuid binary (like /usr/bin/su or /usr/bin/sudo), an attacker can “poison” the version of the program sitting in memory. When that binary is executed, it runs the attacker’s modified instructions—granting them root access—even though the file on the physical disk remains unchanged.

---

📉 Impact & Vulnerability

• CVSS Score: 7.8 (High)

• Affected Range: Linux kernels 4.14 through 7.0-rc.

• Distributions: Ubuntu (20.04, 22.04, 24.04), Amazon Linux 2023, RHEL (8, 9, 10.1), SUSE, Debian, Fedora, and more.

• Cloud/Containers: This is a major threat to Kubernetes and multi-tenant environments. Because the page cache is shared between the host and containers, a compromised container can potentially escalate to the host or affect other containers.

---

🛡 Mitigation & Fixes

1. The Permanent Fix (Recommended)

Update your kernel immediately. Major vendors have begun pushing patches that revert the problematic 2017 optimization.

• RHEL/Alma/Rocky: dnf update kernel

• Ubuntu/Debian: apt update && apt upgrade

• CloudLinux: Already released KernelCare livepatches.

2. Temporary Workarounds

If you cannot reboot or patch immediately, you can attempt to disable the vulnerable module.

Note: On many enterprise distributions (like RHEL), this module is built into the kernel, meaning rmmod or modprobe blacklisting will not work. In those cases, use the GRUB method.

• Option A: Modprobe (Only if compiled as a module)

  Bash

  echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
  rmmod algif_aead
  

• Option B: GRUB Blacklist (Most reliable for built-in modules)

  Add initcall_blacklist=algif_aead_init to your kernel boot parameters in /etc/default/grub, then update your grub config and reboot.

3. Container Hardening

Use Seccomp profiles to block the creation of AF_ALG sockets. Most standard applications do not require this socket type, and blocking it prevents the exploit from initializing.

---

[!IMPORTANT]

A public 732-byte Python exploit script is currently circulating. If your systems allow untrusted users or workloads (like CI/CD runners), they should be prioritized for patching immediately.