CVE-2026-31431

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-31431 7.8

Linux · Kernel · Added 2026-05-01 · Published 2026-04-22

3-Day Required PoC Available KEV Active Exploitation

Details

VulnerabilityLinux Kernel Incorrect Resource Transfer Between Spheres Vulnerability

VendorLinux

ProductKernel

Date added2026-05-01

Due date2026-05-15

CISA catalogView on CISA KEV catalog

Required action"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWECWE-669

CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation.

NVD: In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.

Compliance SSVC + BOD 26-04

Automatableno

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline14 days

Forensic (public)Required

Forensic (non-public)Not required

Research metadata

Last researched2026-08-26 13:45 UTC

Wall time120.0s

Searches8

Component defaultyes

Sources https://nvd.nist.gov/vuln/detail/CVE-2026-31431
https://github.com/adysec/cve-2026-31431
https://github.com/mfloresdacunha/CVE-2026-31431
https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_potential_copy_fail_cve_2026_31431_exploitation_via_af_alg_socket
https://www.sysdig.com/blog/cve-2026-31431-copy-fail-linux-kernel-flaw-lets-local-users-gain-root-in-seconds
https://cert.europa.eu/publications/security-advisories/2026-005/
https://www.rapid7.com/db/modules/exploit/linux/local/cve_2026_31431_copy_fail/
https://github.com/rootsecdev/cve_2026_31431
https://www.openwall.com/lists/oss-security/2026/04/29/23
https://securitylabs.datadoghq.com/articles/cve-2026-31431-copy-fail-exploit-detection-with-agents/
https://github.com/vyahello/CVE-2026-31431
https://hacktricks.wiki/en/linux-hardening/privilege-escalation/linux-kernel-exploitation/copy-fail-af_alg-splice-page-cache-overwrite-cve-2026-31431.html
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5
https://github.com/SpenserCai/copy_fail
https://github.com/0xShe/CVE-2026-31431
https://github.com/theori-io/copy-fail-CVE-2026-31431
https://unit42.paloaltonetworks.com/cve-2026-31431-copy-fail/
https://www.microsoft.com/en-us/security/blog/2026/05/01/cve-2026-31431-copy-fail-vulnerability-enables-linux-root-privilege-escalation/
https://xint.io/blog/copy-fail-linux-distributions
https://copy.fail
https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/05/CSA_research_note_linux_copy_fail_CVE-2026-31431_20260503-csa-styled.pdf

Hunting hypothesis agent

Hunt auditd for unprivileged AF_ALG bind (family 38) to authencesn, setsockopt(SOL_ALG), then splice() of S_ISUID files or /etc/pam.d/* — the Copy Fail CVE-2026-31431 page-cache corruption chain.

Research details

Componentcrypto/algif_aead — AF_ALG AEAD socket interface combined with the authencesn(hmac(sha256),cbc(aes)) IPsec ESN cryptographic template; in-place decrypt optimization (commit 72548b093ee3, 2017) chains page-cache pages into the writable destination scatterlist

PreconditionsThe attacker must have local unprivileged (non-root) shell access to a Linux system running a vulnerable kernel. The vulnerability, nicknamed 'Copy Fail' (CVE-2026-31431), affects essentially all Linux kernels built between 2017 (commit 72548b093ee3 introducing in-place AEAD optimization in algif_aead.c) and the fix in April 2026 — encompassing kernel versions from 4.14 through 6.18.22 (pre-6.18.22), 6.19.x (pre-6.19.12), and 7.0-rc. The AF_ALG socket family is enabled by default on virtually all general-purpose Linux distributions, and the algif_aead kernel module is likewise either compiled in or loadable by default. The exploit chains three independent kernel features: (1) AF_ALG socket creation — an unprivileged user opens an AF_ALG socket of type 'aead' and binds it to the compound transform authencesn(hmac(sha256),cbc(aes)). (2) The splice() system call — zero-copy data transfer that passes page-cache pages by reference (not by copy) into the crypto scatterlist; a readable file (e.g., /usr/bin/su) is opened and its page-cache pages are spliced into the AF_ALG socket's input path. (3) The authencesn AEAD template's scratch-write behavior — during decryption, the kernel rearranges Extended Sequence Number (ESN) bytes by writing 4 bytes (seqno_lo from AAD bytes 4-7) at dst[assoclen + cryptlen], using the destination buffer as scratch space. Because algif_aead's in-place optimization set req->src = req->dst and chained tag pages from the source (which came from splice) into the destination via sg_chain(), the scratch write crosses the legitimate output boundary into the page-cache pages of the spliced file. The 4-byte write is deterministic (no race condition, no kernel memory corruption offsets needed), is attacker-controlled (which file via splice, which offset via assoclen, which value via AAD bytes 4-7), and persists in the page cache even though the decrypt operation fails HMAC verification and returns EBADMSG. The on-disk file is NOT modified — only the in-memory page cache is corrupted, bypassing file integrity checkers, inotify, and inode timestamps. Subsequent execution of the corrupted setuid-root binary (e.g., /usr/bin/su) loads the patched page-cache image, executing attacker shellcode with euid=0. Multiple public PoC exploits exist (Python, C, Rust, Go, Metasploit module) targeting /usr/bin/su, /etc/passwd UID field, and PAM configuration files. The exploit also enables container escape on Kubernetes nodes due to the shared host page cache. Mitigations include: (a) patching to kernel >=6.18.22, >=6.19.12, or >=7.0 (commit a664bf3d603d), (b) disabling algif_aead via modprobe blacklist (echo 'install algif_aead /bin/false' > /etc/modprobe.d/disable-algif.conf), (c) blocking AF_ALG socket creation via seccomp policies on containerized workloads. agent

DeliveryLocal exploitation via AF_ALG socket (family=38, type=SOCK_SEQPACKET) bound to authencesn(hmac(sha256),cbc(aes)) cryptographic template, chained with splice() system call to inject page-cache pages into the crypto pipeline, then recvmsg() to trigger in-place AEAD decryption and the 4-byte scratch write past the output boundary into file page cache

Public PoCyes

Advisoryhttps://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5

Exploit notesCVSS attack complexity: LOW | HIGH severity (CVSS 7.8) | Exploit is deterministic (no race conditions, no ASLR bypass, no kernel offsets required) | Single 732-byte Python script works unmodified across Ubuntu, Amazon Linux, RHEL, SUSE | Affects all kernels 4.14 through 6.18.22/6.19.11 (built since 2017) | AF_ALG available by default on virtually all distributions | Metasploit module available | Container escape possible via shared host page cache

SummaryLinux Kernel (CVE-2026-31431 'Copy Fail') | Logic flaw in crypto/algif_aead AF_ALG in-place optimization (2017 commit 72548b093ee3) chains page-cache pages into writable scatterlist | authencesn scratch write (4 bytes at dst[assoclen+cryptlen]) enables deterministic page-cache corruption of any readable file | Unprivileged local user → root via setuid binary corruption | Affects all Linux distros shipping kernels 4.14–6.19.11 | Multiple public PoCs (Python/C/Rust/Go/Metasploit) | Fixed in commit a664bf3d603d (6.18.22+, 6.19.12+, 7.0+) | Mitigation: disable algif_aead or block AF_ALG via seccomp

Tia coverage

First reported2026-04-30

First exploit report2026-05-02

Exploit report → KEV1 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

dirty-frag-another-universal-linux-root-zero-day-same-class-as-c fragnesia-new-dirty-frag-class-linux-kernel-lpe-cve-2026-46300-p iot-malware-uses-public-linux-exploits-to-gain-root-and-turn-dev linux-kernel-copy-fail-zero-day-cve-2026-31431-grants-unprivileg

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.