CVE-2026-31431: “Copy Fail” – root on every major Linux distro in 732 bytes

A logic flaw in the Linux kernel’s cryptographic subsystem lets any unprivileged local user write to the page cache of privileged binaries – gaining root access without a race condition, without recompiling anything, and without crashing the system.

A logic flaw in the Linux kernel’s cryptographic subsystem lets any unprivileged local user write to the page cache of privileged binaries – gaining root access without a race condition, without recompiling anything, and without crashing the system.

What is this vulnerability?

Copy Fail is a logic flaw in algif_aead – the AEAD (authenticated encryption) socket interface that exposes kernel crypto operations to userspace via AF_ALG sockets. The bug was introduced in July 2017 with a commit that switched AEAD operations to process data in-place rather than copying it.

That in-place optimisation placed page cache pages into a writable scatterlist. The authencesn algorithm – used by IPsec for extended sequence number (ESN) support – writes four bytes of scratch data as part of its operation. Those four bytes land inside the page cache of whatever file was spliced into the socket, not into a safe scratch buffer.

The result: any unprivileged user can make a controlled, deterministic 4-byte write into the in-memory copy of any readable file on the system – including setuid root binaries like /usr/bin/sudo or /bin/su. Overwrite the right bytes, and the binary now runs attacker-controlled code as root.

How does the exploit work?

The published proof of concept is a 732-byte Python script using only the standard library. The technique chains three standard Linux syscalls:

Because there is no race condition and no timing window, the exploit succeeds on the first attempt every time. It requires Python 3.10+ for os.splice and no compiled code or external dependencies.

Who is affected?

Any system running a Linux kernel between version 4.14 and the patched releases, where CONFIG_CRYPTO_USER_API_AEAD=y is set – which is the default on essentially all distributions. The regression was introduced in July 2017 and had been present for nearly nine years.

While there is no standalone remote vector, this becomes critical when chained with common initial access techniques: SSH access with a low-privilege account, a web application RCE, a malicious CI/CD job, or a container foothold where the container shares the host kernel.

Patch and distribution status

As of 4 May 2026:

Patched

Patch pending – use workaround

Immediate mitigation – disable the module

CERT-EU and Ubuntu both recommend disabling algif_aead as an interim measure. This does not affect dm-crypt, LUKS, kTLS, IPsec/XFRM, OpenSSL, GnuTLS, NSS, or SSH.

echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
rmmod algif_aead 2>/dev/null || true

You can check whether any process is currently using AF_ALG sockets before removing the module:

lsof | grep AF_ALG

If the module is in active use, a reboot after applying the config file will safely disable it, allowing applications to fall back to non-accelerated crypto.

Detection

The exploit relies entirely on standard syscalls – socket, setsockopt, splice, sendmsg, recvmsg. There is no unusual binary execution or network traffic to detect at the OS level. Host-based detection should look for:

Sysdig Secure has a published detection rule “AF_ALG Page Cache Poisoning Leading to Privilege Escalation.” Microsoft Defender Vulnerability Management surfaces affected devices under the CVE-2026-31431 identifier.

Disclosure timeline

The bigger picture

What makes Copy Fail notable beyond its severity is how it was found. Theori’s Xint Code automated security scanner identified the flaw with approximately one hour of runtime and a single operator prompt pointing it at the kernel’s crypto/ directory. The bug had been missed by human review for nearly nine years.

This has implications for shared-kernel deployment models. Namespace-based container isolation was never a security boundary against a compromised host kernel. If your threat model includes potentially malicious workloads on shared kernel hosts – public CI/CD pipelines, multi-tenant compute, Kubernetes with untrusted pods – Copy Fail is a reminder that a VM or hardware boundary is the appropriate isolation primitive, not cgroups and namespaces.