Linux Kernel 'Copy Fail' Local Privilege Escalation (CVE-2026-31431) — algif_aead 4-Byte Page Cache Write to setuid Root

Linux Kernel 'Copy Fail' Local Privilege Escalation (TL-2026-0445), also tracked as Copy Fail, is a high-severity software vulnerability scored CVSS 7.8, first published 2026-04-30 and last reviewed 2026-09-10. It has no confirmed attribution, affects Linux Kernel Organization Linux kernel, references 1 CVE (CVE-2026-31431), maps to 21 MITRE ATT&CK techniques (T1059, T1068, T1070), and is covered by 9 detection rules and 32 indicators of compromise.

Key facts for TL-2026-0445

Threat ID
TL-2026-0445
Also known as
Copy Fail, CopyFail, algif_aead 4-byte write
Severity
HIGH
CVSS
7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-04-30
Last reviewed
2026-09-10
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
technology, cloud_services, financial, healthcare, government, education, telecommunications, manufacturing, managed_service_providers
Target regions
Global
Detection rules
9
Indicators of compromise
32
Updates
2026-09-10 · revalidated 1× · latest source

Malware and tooling in Linux Kernel 'Copy Fail' Local Privilege Escalation

Malware and tooling: None — local-only exploit; no remote C2 component

CVE-2026-31431 ("Copy Fail") is a logic flaw in the Linux kernel's algif_aead userspace crypto interface that lets any unprivileged local user chain AF_ALG and splice() into a 4-byte arbitrary write directly into the read-only page cache of any readable file. A 732-byte Python PoC published by Theori on 2026-04-29 corrupts /usr/bin/su in memory and yields root in seconds on Ubuntu 24.04, Amazon Linux 2023, RHEL 10.1, and SUSE 16 with no per-distro tuning. The same primitive is a container/Kubernetes node escape because the page cache is shared across containers on the host.

How Linux Kernel 'Copy Fail' Local Privilege Escalation works

Copy Fail is a high-impact local privilege escalation in the Linux kernel's algif_aead module (the AF_ALG socket family used to expose authenticated-encryption transforms to userspace). The root cause is an in-place AEAD optimization introduced by commit 72548b093ee3 in July 2017: when a userspace caller hands the kernel scatter-gather pages via splice() and then issues recvmsg() with a small associated-data (AAD) buffer, the algif_aead code reuses a 4-byte scratch region that is computed against the source pages of the splice rather than a kernel-owned buffer. Because splice() can be pointed at the page cache of any file the user can read, the 4-byte write lands directly in the in-memory copy of that file, bypassing the read-only mapping and the file's on-disk permissions.

The exploit chain is unusually compact and reliable. The PoC opens an AF_ALG socket bound to authencesn(hmac(sha256),cbc(aes)), splices several pages of /usr/bin/su into the AEAD pipeline, then triggers recvmsg() with a crafted AAD length so the chained-tag scratch write lands at a chosen 4-byte-aligned offset inside the binary's .text section. Theori's release patches a single SUB instruction in su's authentication path so that any password (or no password) succeeds, then re-execs su to gain a root shell. Because the page is never marked dirty, writeback never persists the change to disk and the attack is forensically near-invisible on the file system; only the kernel's resident page cache is corrupted, and the implant disappears on reboot or page reclaim.

Reach is essentially every supported Linux kernel from 4.14 through 7.0-rc and all LTS branches that backported the 2017 in-place AEAD work (6.18.x, 6.12.x, 6.6.x, 5.15.x, 5.10.x). Theori validated the unmodified 732-byte Python PoC against Ubuntu 24.04, Amazon Linux 2023, RHEL 10.1, and SUSE Linux Enterprise 16 stock kernels. Linus merged a664bf3d603d on 2026-04-01 hardening the AEAD scatter-gather path, with fafe0fa2995a closing out the series in early April; mainline fixes ship in 7.0 and the 6.19.12 / 6.18.22 stable points. Distribution kernels began rolling on 2026-04-30. CERT-EU rated the issue High and Sysdig flagged active exploitation interest within hours of PoC release.

The container escape primitive is what elevates Copy Fail beyond a routine LPE. On Linux, the page cache is keyed by inode and is shared across every container that mounts the same backing file system or shares a host volume. A compromised, unprivileged process inside a container can therefore corrupt /usr/bin/su (or any other setuid root binary) in the host's page cache, and the next time a host-side process or another container reads that page, it sees the modified bytes. In Kubernetes deployments where overlay filesystems share read-only base layers, a single tenant pod running this PoC can compromise sibling pods and the kubelet on the same node. Container security vendors (Sysdig, Aqua, Wiz) have published runtime detections targeting AF_ALG socket creation followed by splice() into setuid binaries, and CIS now recommends disabling CONFIG_CRYPTO_USER_API_AEAD or seccomp-blocking AF_ALG (family 38) in container baselines.

MITRE ATT&CK techniques used in TL-2026-0445

Execution

T1059 Command and Scripting Interpreter; T1106 Native API

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism; T1611 Escape to Host

Defense Evasion

T1070 Indicator Removal; T1211 Exploitation for Stealth; T1620 Reflective Code Loading

Discovery

T1082 System Information Discovery; T1083 File and Directory Discovery; T1613 Container and Resource Discovery

Command and Control

T1105 Ingress Tool Transfer

Lateral Movement

T1210 Exploitation of Remote Services

Credential Access

T1212 Exploitation for Credential Access

Persistence

T1543 Create or Modify System Process

defense-impairment

T1553 Subvert Trust Controls; T1601 Modify System Image

Impact

T1565.001 Data Manipulation: Stored Data Manipulation

stealth

T1574 Hijack Execution Flow

Resource Development

T1587 Develop Capabilities; T1588.005 Obtain Capabilities: Exploits

Affected products and versions in Linux Kernel 'Copy Fail' Local Privilege Escalation

  • Linux Kernel Organization — Linux kernel
    Vulnerable versions: 4.14 through 7.0-rc; 6.19.0 - 6.19.11; 6.18.0 - 6.18.21; 6.12.x LTS prior to backport; 6.6.x LTS prior to backport; 5.15.x LTS prior to backport; 5.10.x LTS prior to backport
    Fixed in: 7.0; 6.19.12; 6.18.22
  • Canonical — Ubuntu
    Vulnerable versions: 24.04 LTS; 22.04 LTS; 20.04 LTS
    Fixed in: 24.04 with USN-7142-1 kernel
  • Amazon Web Services — Amazon Linux 2023
    Vulnerable versions: AL2023 stock kernel < 6.12.x patched
    Fixed in: AL2023 with ALAS2023-2026-845
  • Red Hat — Red Hat Enterprise Linux
    Vulnerable versions: RHEL 10.1; RHEL 9.x; RHEL 8.x
    Fixed in: RHEL 10.1 with RHSA-2026:1812
  • SUSE — SUSE Linux Enterprise
    Vulnerable versions: SLE 16; SLE 15 SP6
    Fixed in: SLE 16 with SUSE-SU-2026:1431-1
  • Debian — Debian GNU/Linux
    Vulnerable versions: 12 (bookworm); 13 (trixie)
    Fixed in: 13 with DSA-5689-1
  • Oracle — Oracle Linux
    Vulnerable versions: OL 9; OL 10
    Fixed in: OL 10 with ELSA-2026-1812

Remediation for Linux Kernel 'Copy Fail' Local Privilege Escalation

Patches

  • Linux mainline 7.0 (includes a664bf3d603d and fafe0fa2995a)
  • Linux stable 6.19.12
  • Linux stable 6.18.22
  • Ubuntu USN-7142-1 (linux, linux-aws, linux-azure, linux-gcp) 2026-04-30
  • RHEL RHSA-2026:1812 (kernel, kernel-rt) 2026-04-30
  • Amazon Linux ALAS2023-2026-845 2026-04-30
  • SUSE SUSE-SU-2026:1431-1 2026-04-30
  • Debian DSA-5689-1 2026-04-30
  • Oracle Linux ELSA-2026-1812 2026-04-30

Immediate actions

  • Apply distribution kernel updates shipping the a664bf3d603d backport (Ubuntu USN, RHEL RHSA, Amazon ALAS, SUSE SUSE-SU advisories published 2026-04-30 onward)
  • On unpatched hosts, blacklist the algif_aead and af_alg modules: echo 'install algif_aead /bin/true' > /etc/modprobe.d/copyfail.conf && rmmod algif_aead
  • In container baselines, add a seccomp deny rule for socket(AF_ALG, ...) (family value 38) — both Docker default and Kubernetes restricted profiles received updates
  • Audit /var/log/auth.log and audit.log for unexpected su/sudo successes and AF_ALG socket creation by non-root UIDs over the last 7 days

Workarounds

  • Blacklist kernel modules algif_aead and af_alg via /etc/modprobe.d and unload running instances
  • Block syscall socket(AF_ALG, SOCK_SEQPACKET, 0) at seccomp/audit layer for unprivileged users
  • Set fs.protected_hardlinks=1 and fs.protected_symlinks=1 (defense-in-depth, does not block primary primitive)
  • On Kubernetes, set securityContext.seccompProfile.type=RuntimeDefault and add a custom profile denying AF_ALG

Longer-term hardening

  • Adopt Sysdig/Falco rule 'AF_ALG splice into setuid binary' or vendor equivalent across Linux fleets
  • Disable CONFIG_CRYPTO_USER_API_AEAD in custom and embedded kernel builds where userspace crypto is not required
  • Move container workloads to read-only root filesystems with noexec on /tmp and /var/tmp to limit post-exploit foothold
  • Use eBPF-based runtime defense (Tetragon, Cilium Tetragon) to alert on splice() with src_fd referencing setuid binaries
  • Enforce kernel module signing (CONFIG_MODULE_SIG_FORCE) and lockdown=integrity to make rmmod/insmod tampering harder for post-root persistence

CVEs associated with Linux Kernel 'Copy Fail' Local Privilege Escalation

CVE-2026-31431

Weaknesses (CWE) in Linux Kernel 'Copy Fail' Local Privilege Escalation

CWE-787, CWE-665, CWE-362, CWE-669, CWE-1288

Timeline of Linux Kernel 'Copy Fail' Local Privilege Escalation

  • authencesn AEAD template's scratch-write behavior (reordering IPsec ESN bytes into the destination buffer) added to the kernel; harmless until AF_ALG AEAD support existed.
  • AF_ALG gains AEAD support using out-of-place operation, keeping page-cache pages read-only so the scratch write cannot yet reach attacker-influenced memory.
  • Linux mainline commit 72548b093ee3 lands the in-place AEAD optimization in algif_aead, silently introducing the 4-byte scratch-write logic flaw that becomes Copy Fail.
  • Theori/Xint Code Research Team identifies the algif_aead in-place write primitive during an internal Linux kernel audit and begins responsible disclosure to linux-distros.
  • Theori submits coordinated disclosure to the Linux kernel security list and major downstream distributions (Canonical, Red Hat, SUSE, Amazon, Debian, Oracle) under linux-distros embargo.
  • Linus Torvalds merges fix commit a664bf3d603d into mainline, validating the scatterlist before AEAD recvmsg() and preventing the 4-byte page-cache write.
  • Mainline commit fafe0fa2995a closes out the patch series with tighter AAD length checks; backports to 6.19.x and 6.18.x stable trees begin queueing.
  • CVE-2026-31431 is officially assigned and the Linux kernel CVE announcement is published.
  • Theori publishes the Copy Fail technical write-up on xint.io and releases the 732-byte Python PoC at github.com/theori-io/copy-fail-CVE-2026-31431; community member tgies releases a portable C port.
  • Cloudflare declares an internal security incident after a fleet-wide threat hunt found no evidence of exploitation in its own environment, and rolls out an eBPF LSM (bpf-lsm) mitigation gating AF_ALG socket_bind by allow-list.
  • Threadlinqs Intelligence ingests the advisory, Researcher publishes TL-2026-0445 with full MITRE, IOC, and detection coverage.
  • Sysdig Threat Research notes opportunistic scanning and download spikes for the public PoC across honeypots; container security vendors (Aqua, Wiz) push runtime detections targeting AF_ALG socket creation followed by splice() into setuid binaries.
  • Sysdig, BleepingComputer, The Register, Bugcrowd, and CERT-EU publish advisories. Ubuntu (USN-7142-1), Red Hat (RHSA-2026:1812), Amazon (ALAS2023-2026-845), SUSE (SUSE-SU-2026:1431-1), Debian (DSA-5689-1), and Oracle (ELSA-2026-1812) ship patched kernels.
  • Go and Rust reimplementations of the original Python PoC circulate on GitHub; Rust variants add support for custom shellcode payloads including Meterpreter and vary syscall sequencing versus the original.
  • CISA adds CVE-2026-31431 to its Known Exploited Vulnerabilities catalog as 'Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability,' citing active exploitation, with a BOD 22-01 remediation due date of 2026-05-15; Microsoft publishes Defender detection signatures the same day.
  • Cloudflare resumes its automated patched-kernel reboot rollout across its fleet.
  • CISA's BOD 22-01 remediation deadline for federal civilian agencies to patch or mitigate CVE-2026-31431.
  • As of 2026-05-29, CVE-2026-31431 "Copy Fail" remains a live, high-urgency threat: CISA added it to the KEV catalog (~May 1-3) after confirming in-the-wild exploitation, with a reliable public 732-byte PoC and a vast unpatched Linux/Kubernetes fleet. Distro patches shipped Apr 30-May 1, but exploitation continues (currently mostly PoC-driven per Microsoft), keeping status ACTIVE.
  • NVD CVE-2026-31431 record last modified, reflecting ongoing vendor advisory and patch-status updates.

Update history for TL-2026-0445

Sources cited for Linux Kernel 'Copy Fail' Local Privilege Escalation

Threats related to Linux Kernel 'Copy Fail' Local Privilege Escalation

Detection coverage for TL-2026-0445

As of 2026-09-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0445 across Splunk SPL, Microsoft KQL and Sigma, covering 32 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats