Threat reportVulnerabilityTL-2026-0445
Linux Kernel 'Copy Fail' Local Privilege Escalation (CVE-2026-31431) — algif_aead 4-Byte Page Cache Write to setuid Root
Linux Kernel 'Copy Fail' Local Privilege Escalation (TL-2026-0445), also tracked as Copy Fail, is a high-severity software vulnerability scored CVSS 7.8, first published 2026-04-30 and last reviewed 2026-09-10. It has no confirmed attribution, affects Linux Kernel Organization Linux kernel, references 1 CVE (CVE-2026-31431), maps to 21 MITRE ATT&CK techniques (T1059, T1068, T1070), and is covered by 9 detection rules and 32 indicators of compromise.
- CVSS
- 7.8/10High
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 21MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 32Indicators of compromise
Key facts for TL-2026-0445
- Threat ID
- TL-2026-0445
- Also known as
- Copy Fail, CopyFail, algif_aead 4-byte write
- Severity
- HIGH
- CVSS
- 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- technology, cloud_services, financial, healthcare, government, education, telecommunications, manufacturing, managed_service_providers
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 32
- Updates
- 2026-09-10 · revalidated 1× · latest source
Malware and tooling in Linux Kernel 'Copy Fail' Local Privilege Escalation
Malware and tooling: None — local-only exploit; no remote C2 component
How Linux Kernel 'Copy Fail' Local Privilege Escalation works
CVE-2026-31431 ("Copy Fail") is a logic flaw in the Linux kernel's algif_aead userspace crypto interface that lets any unprivileged local user chain AF_ALG and splice() into a 4-byte arbitrary write directly into the read-only page cache of any readable file. A 732-byte Python PoC published by Theori on 2026-04-29 corrupts /usr/bin/su in memory and yields root in seconds on Ubuntu 24.04, Amazon Linux 2023, RHEL 10.1, and SUSE 16 with no per-distro tuning. The same primitive is a container/Kubernetes node escape because the page cache is shared across containers on the host.
Copy Fail is a high-impact local privilege escalation in the Linux kernel's algif_aead module (the AF_ALG socket family used to expose authenticated-encryption transforms to userspace). The root cause is an in-place AEAD optimization introduced by commit 72548b093ee3 in July 2017: when a userspace caller hands the kernel scatter-gather pages via splice() and then issues recvmsg() with a small associated-data (AAD) buffer, the algif_aead code reuses a 4-byte scratch region that is computed against the source pages of the splice rather than a kernel-owned buffer. Because splice() can be pointed at the page cache of any file the user can read, the 4-byte write lands directly in the in-memory copy of that file, bypassing the read-only mapping and the file's on-disk permissions.
The exploit chain is unusually compact and reliable. The PoC opens an AF_ALG socket bound to authencesn(hmac(sha256),cbc(aes)), splices several pages of /usr/bin/su into the AEAD pipeline, then triggers recvmsg() with a crafted AAD length so the chained-tag scratch write lands at a chosen 4-byte-aligned offset inside the binary's .text section. Theori's release patches a single SUB instruction in su's authentication path so that any password (or no password) succeeds, then re-execs su to gain a root shell. Because the page is never marked dirty, writeback never persists the change to disk and the attack is forensically near-invisible on the file system; only the kernel's resident page cache is corrupted, and the implant disappears on reboot or page reclaim.
Reach is essentially every supported Linux kernel from 4.14 through 7.0-rc and all LTS branches that backported the 2017 in-place AEAD work (6.18.x, 6.12.x, 6.6.x, 5.15.x, 5.10.x). Theori validated the unmodified 732-byte Python PoC against Ubuntu 24.04, Amazon Linux 2023, RHEL 10.1, and SUSE Linux Enterprise 16 stock kernels. Linus merged a664bf3d603d on 2026-04-01 hardening the AEAD scatter-gather path, with fafe0fa2995a closing out the series in early April; mainline fixes ship in 7.0 and the 6.19.12 / 6.18.22 stable points. Distribution kernels began rolling on 2026-04-30. CERT-EU rated the issue High and Sysdig flagged active exploitation interest within hours of PoC release.
The container escape primitive is what elevates Copy Fail beyond a routine LPE. On Linux, the page cache is keyed by inode and is shared across every container that mounts the same backing file system or shares a host volume. A compromised, unprivileged process inside a container can therefore corrupt /usr/bin/su (or any other setuid root binary) in the host's page cache, and the next time a host-side process or another container reads that page, it sees the modified bytes. In Kubernetes deployments where overlay filesystems share read-only base layers, a single tenant pod running this PoC can compromise sibling pods and the kubelet on the same node. Container security vendors (Sysdig, Aqua, Wiz) have published runtime detections targeting AF_ALG socket creation followed by splice() into setuid binaries, and CIS now recommends disabling CONFIG_CRYPTO_USER_API_AEAD or seccomp-blocking AF_ALG (family 38) in container baselines.
MITRE ATT&CK techniques used in TL-2026-0445
Execution
T1059 Command and Scripting Interpreter; T1106 Native API
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism; T1611 Escape to Host
Defense Evasion
T1070 Indicator Removal; T1211 Exploitation for Stealth; T1620 Reflective Code Loading
Discovery
T1082 System Information Discovery; T1083 File and Directory Discovery; T1613 Container and Resource Discovery
Command and Control
Lateral Movement
T1210 Exploitation of Remote Services
Credential Access
T1212 Exploitation for Credential Access
Persistence
T1543 Create or Modify System Process
defense-impairment
T1553 Subvert Trust Controls; T1601 Modify System Image
Impact
T1565.001 Data Manipulation: Stored Data Manipulation
stealth
Resource Development
T1587 Develop Capabilities; T1588.005 Obtain Capabilities: Exploits
Affected products and versions in Linux Kernel 'Copy Fail' Local Privilege Escalation
- Linux Kernel Organization — Linux kernel
Vulnerable versions: 4.14 through 7.0-rc; 6.19.0 - 6.19.11; 6.18.0 - 6.18.21; 6.12.x LTS prior to backport; 6.6.x LTS prior to backport; 5.15.x LTS prior to backport; 5.10.x LTS prior to backport
Fixed in: 7.0; 6.19.12; 6.18.22 - Canonical — Ubuntu
Vulnerable versions: 24.04 LTS; 22.04 LTS; 20.04 LTS
Fixed in: 24.04 with USN-7142-1 kernel - Amazon Web Services — Amazon Linux 2023
Vulnerable versions: AL2023 stock kernel < 6.12.x patched
Fixed in: AL2023 with ALAS2023-2026-845 - Red Hat — Red Hat Enterprise Linux
Vulnerable versions: RHEL 10.1; RHEL 9.x; RHEL 8.x
Fixed in: RHEL 10.1 with RHSA-2026:1812 - SUSE — SUSE Linux Enterprise
Vulnerable versions: SLE 16; SLE 15 SP6
Fixed in: SLE 16 with SUSE-SU-2026:1431-1 - Debian — Debian GNU/Linux
Vulnerable versions: 12 (bookworm); 13 (trixie)
Fixed in: 13 with DSA-5689-1 - Oracle — Oracle Linux
Vulnerable versions: OL 9; OL 10
Fixed in: OL 10 with ELSA-2026-1812
Remediation for Linux Kernel 'Copy Fail' Local Privilege Escalation
Patches
- Linux mainline 7.0 (includes a664bf3d603d and fafe0fa2995a)
- Linux stable 6.19.12
- Linux stable 6.18.22
- Ubuntu USN-7142-1 (linux, linux-aws, linux-azure, linux-gcp) 2026-04-30
- RHEL RHSA-2026:1812 (kernel, kernel-rt) 2026-04-30
- Amazon Linux ALAS2023-2026-845 2026-04-30
- SUSE SUSE-SU-2026:1431-1 2026-04-30
- Debian DSA-5689-1 2026-04-30
- Oracle Linux ELSA-2026-1812 2026-04-30
Immediate actions
- Apply distribution kernel updates shipping the a664bf3d603d backport (Ubuntu USN, RHEL RHSA, Amazon ALAS, SUSE SUSE-SU advisories published 2026-04-30 onward)
- On unpatched hosts, blacklist the algif_aead and af_alg modules: echo 'install algif_aead /bin/true' > /etc/modprobe.d/copyfail.conf && rmmod algif_aead
- In container baselines, add a seccomp deny rule for socket(AF_ALG, ...) (family value 38) — both Docker default and Kubernetes restricted profiles received updates
- Audit /var/log/auth.log and audit.log for unexpected su/sudo successes and AF_ALG socket creation by non-root UIDs over the last 7 days
Workarounds
- Blacklist kernel modules algif_aead and af_alg via /etc/modprobe.d and unload running instances
- Block syscall socket(AF_ALG, SOCK_SEQPACKET, 0) at seccomp/audit layer for unprivileged users
- Set fs.protected_hardlinks=1 and fs.protected_symlinks=1 (defense-in-depth, does not block primary primitive)
- On Kubernetes, set securityContext.seccompProfile.type=RuntimeDefault and add a custom profile denying AF_ALG
Longer-term hardening
- Adopt Sysdig/Falco rule 'AF_ALG splice into setuid binary' or vendor equivalent across Linux fleets
- Disable CONFIG_CRYPTO_USER_API_AEAD in custom and embedded kernel builds where userspace crypto is not required
- Move container workloads to read-only root filesystems with noexec on /tmp and /var/tmp to limit post-exploit foothold
- Use eBPF-based runtime defense (Tetragon, Cilium Tetragon) to alert on splice() with src_fd referencing setuid binaries
- Enforce kernel module signing (CONFIG_MODULE_SIG_FORCE) and lockdown=integrity to make rmmod/insmod tampering harder for post-root persistence
CVEs associated with Linux Kernel 'Copy Fail' Local Privilege Escalation
Weaknesses (CWE) in Linux Kernel 'Copy Fail' Local Privilege Escalation
Timeline of Linux Kernel 'Copy Fail' Local Privilege Escalation
- authencesn AEAD template's scratch-write behavior (reordering IPsec ESN bytes into the destination buffer) added to the kernel; harmless until AF_ALG AEAD support existed.
- AF_ALG gains AEAD support using out-of-place operation, keeping page-cache pages read-only so the scratch write cannot yet reach attacker-influenced memory.
- Linux mainline commit 72548b093ee3 lands the in-place AEAD optimization in algif_aead, silently introducing the 4-byte scratch-write logic flaw that becomes Copy Fail.
- Theori/Xint Code Research Team identifies the algif_aead in-place write primitive during an internal Linux kernel audit and begins responsible disclosure to linux-distros.
- Theori submits coordinated disclosure to the Linux kernel security list and major downstream distributions (Canonical, Red Hat, SUSE, Amazon, Debian, Oracle) under linux-distros embargo.
- Linus Torvalds merges fix commit a664bf3d603d into mainline, validating the scatterlist before AEAD recvmsg() and preventing the 4-byte page-cache write.
- Mainline commit fafe0fa2995a closes out the patch series with tighter AAD length checks; backports to 6.19.x and 6.18.x stable trees begin queueing.
- CVE-2026-31431 is officially assigned and the Linux kernel CVE announcement is published.
- Theori publishes the Copy Fail technical write-up on xint.io and releases the 732-byte Python PoC at github.com/theori-io/copy-fail-CVE-2026-31431; community member tgies releases a portable C port.
- Cloudflare declares an internal security incident after a fleet-wide threat hunt found no evidence of exploitation in its own environment, and rolls out an eBPF LSM (bpf-lsm) mitigation gating AF_ALG socket_bind by allow-list.
- Threadlinqs Intelligence ingests the advisory, Researcher publishes TL-2026-0445 with full MITRE, IOC, and detection coverage.
- Sysdig Threat Research notes opportunistic scanning and download spikes for the public PoC across honeypots; container security vendors (Aqua, Wiz) push runtime detections targeting AF_ALG socket creation followed by splice() into setuid binaries.
- Sysdig, BleepingComputer, The Register, Bugcrowd, and CERT-EU publish advisories. Ubuntu (USN-7142-1), Red Hat (RHSA-2026:1812), Amazon (ALAS2023-2026-845), SUSE (SUSE-SU-2026:1431-1), Debian (DSA-5689-1), and Oracle (ELSA-2026-1812) ship patched kernels.
- Go and Rust reimplementations of the original Python PoC circulate on GitHub; Rust variants add support for custom shellcode payloads including Meterpreter and vary syscall sequencing versus the original.
- CISA adds CVE-2026-31431 to its Known Exploited Vulnerabilities catalog as 'Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability,' citing active exploitation, with a BOD 22-01 remediation due date of 2026-05-15; Microsoft publishes Defender detection signatures the same day.
- Cloudflare resumes its automated patched-kernel reboot rollout across its fleet.
- CISA's BOD 22-01 remediation deadline for federal civilian agencies to patch or mitigate CVE-2026-31431.
- As of 2026-05-29, CVE-2026-31431 "Copy Fail" remains a live, high-urgency threat: CISA added it to the KEV catalog (~May 1-3) after confirming in-the-wild exploitation, with a reliable public 732-byte PoC and a vast unpatched Linux/Kubernetes fleet. Distro patches shipped Apr 30-May 1, but exploitation continues (currently mostly PoC-driven per Microsoft), keeping status ACTIVE.
- NVD CVE-2026-31431 record last modified, reflecting ongoing vendor advisory and patch-status updates.
Update history for TL-2026-0445
- 2026-09-10 — Copy Fail (CVE-2026-31431): Linux Kernel algif_aead Out-of-Bounds Write Enables Local Root Privilege Escalation: What changed Core severity (HIGH), CVSS (7.8), exploitability (ACTIVE), and status (ACTIVE) are unchanged and confirmed by the newer report. No whitelisted field escalations were evidenced — the newer report's 'impact: CRITICAL' framing is
Sources cited for Linux Kernel 'Copy Fail' Local Privilege Escalation
- Copy Fail: 732 Bytes to Root on Every Major Linux Distribution
- CVE-2026-31431: Copy Fail Linux kernel flaw lets local users gain root in seconds
- What we know about Copy Fail (CVE-2026-31431)
- New Linux 'Copy Fail' flaw gives hackers root on major distros
- Linux cryptographic code flaw offers fast route to root
- CERT-EU Security Advisory 2026-005: High Vulnerability in the Linux Kernel (Copy Fail)
- theori-io/copy-fail-CVE-2026-31431 — official PoC
- tgies/copy-fail-c — cross-platform C port of the Copy Fail PoC
- NVD CVE-2026-31431
- Linux mainline commit a664bf3d603d (algif_aead: validate scatterlist before AEAD recvmsg)
- Linux mainline commit fafe0fa2995a (crypto/algif_aead: tighten AAD length checks)
- Ubuntu USN-7142-1: Linux kernel vulnerability
- Red Hat RHSA-2026:1812 — kernel security update
- Amazon Linux ALAS2023-2026-845
- SUSE SUSE-SU-2026:1431-1
Detection coverage for TL-2026-0445
As of 2026-09-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0445 across Splunk SPL, Microsoft KQL and Sigma, covering 32 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.