# Linux Kernel 'Copy Fail' Local Privilege Escalation (CVE-2026-31431) — algif_aead 4-Byte Page Cache Write to setuid Root

> CVE-2026-31431 ("Copy Fail") is a logic flaw in the Linux kernel's algif_aead userspace crypto interface that lets any unprivileged local user chain AF_ALG and splice() into a 4-byte arbitrary write directly into the read-only page cache of any readable file. A 732-byte Python PoC published by Theori on 2026-04-29 corrupts /usr/bin/su in memory and yields root in seconds on Ubuntu 24.04, Amazon Linux 2023, RHEL 10.1, and SUSE 16 with no per-distro tuning. The same primitive is a container/Kubernetes node escape because the page cache is shared across containers on the host.

- **Published:** 2026-04-30T12:00:00Z
- **Last reviewed:** 2026-09-10T14:29:27.261Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0445
- **ID:** TL-2026-0445
- **Severity:** HIGH (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 32 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-31431

## Description

Copy Fail is a high-impact local privilege escalation in the Linux kernel's algif_aead module (the AF_ALG socket family used to expose authenticated-encryption transforms to userspace). The root cause is an in-place AEAD optimization introduced by commit 72548b093ee3 in July 2017: when a userspace caller hands the kernel scatter-gather pages via splice() and then issues recvmsg() with a small associated-data (AAD) buffer, the algif_aead code reuses a 4-byte scratch region that is computed against the source pages of the splice rather than a kernel-owned buffer. Because splice() can be pointed at the page cache of any file the user can read, the 4-byte write lands directly in the in-memory copy of that file, bypassing the read-only mapping and the file's on-disk permissions.

The exploit chain is unusually compact and reliable. The PoC opens an AF_ALG socket bound to authencesn(hmac(sha256),cbc(aes)), splices several pages of /usr/bin/su into the AEAD pipeline, then triggers recvmsg() with a crafted AAD length so the chained-tag scratch write lands at a chosen 4-byte-aligned offset inside the binary's .text section. Theori's release patches a single SUB instruction in su's authentication path so that any password (or no password) succeeds, then re-execs su to gain a root shell. Because the page is never marked dirty, writeback never persists the change to disk and the attack is forensically near-invisible on the file system; only the kernel's resident page cache is corrupted, and the implant disappears on reboot or page reclaim.

Reach is essentially every supported Linux kernel from 4.14 through 7.0-rc and all LTS branches that backported the 2017 in-place AEAD work (6.18.x, 6.12.x, 6.6.x, 5.15.x, 5.10.x). Theori validated the unmodified 732-byte Python PoC against Ubuntu 24.04, Amazon Linux 2023, RHEL 10.1, and SUSE Linux Enterprise 16 stock kernels. Linus merged a664bf3d603d on 2026-04-01 hardening the AEAD scatter-gather path, with fafe0fa2995a closing out the series in early April; mainline fixes ship in 7.0 and the 6.19.12 / 6.18.22 stable points. Distribution kernels began rolling on 2026-04-30. CERT-EU rated the issue High and Sysdig flagged active exploitation interest within hours of PoC release.

The container escape primitive is what elevates Copy Fail beyond a routine LPE. On Linux, the page cache is keyed by inode and is shared across every container that mounts the same backing file system or shares a host volume. A compromised, unprivileged process inside a container can therefore corrupt /usr/bin/su (or any other setuid root binary) in the host's page cache, and the next time a host-side process or another container reads that page, it sees the modified bytes. In Kubernetes deployments where overlay filesystems share read-only base layers, a single tenant pod running this PoC can compromise sibling pods and the kubelet on the same node. Container security vendors (Sysdig, Aqua, Wiz) have published runtime detections targeting AF_ALG socket creation followed by splice() into setuid binaries, and CIS now recommends disabling CONFIG_CRYPTO_USER_API_AEAD or seccomp-blocking AF_ALG (family 38) in container baselines.

## MITRE ATT&CK

- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1068 Exploitation for Privilege Escalation
- T1548 Abuse Elevation Control Mechanism
- T1611 Escape to Host
- T1211 Exploitation for Stealth
- T1070 Indicator Removal
- T1601 Modify System Image
- T1553 Subvert Trust Controls
- T1212 Exploitation for Credential Access
- T1082 System Information Discovery
- T1613 Container and Resource Discovery
- T1210 Exploitation of Remote Services
- T1543 Create or Modify System Process
- T1574 Hijack Execution Flow
- T1587 Develop Capabilities
- T1588.005 Obtain Capabilities: Exploits
- T1083 File and Directory Discovery
- T1620 Reflective Code Loading
- T1105 Ingress Tool Transfer
- T1565.001 Data Manipulation: Stored Data Manipulation

## Sources

- [Copy Fail: 732 Bytes to Root on Every Major Linux Distribution](https://xint.io/blog/copy-fail-linux-distributions)
- [CVE-2026-31431: Copy Fail Linux kernel flaw lets local users gain root in seconds](https://www.sysdig.com/blog/cve-2026-31431-copy-fail-linux-kernel-flaw-lets-local-users-gain-root-in-seconds)
- [What we know about Copy Fail (CVE-2026-31431)](https://www.bugcrowd.com/blog/what-we-know-about-copy-fail-cve-2026-31431/)
- [New Linux 'Copy Fail' flaw gives hackers root on major distros](https://www.bleepingcomputer.com/news/security/new-linux-copy-fail-flaw-gives-hackers-root-on-major-distros/)
- [Linux cryptographic code flaw offers fast route to root](https://www.theregister.com/2026/04/30/linux_cryptographic_code_flaw/)
- [CERT-EU Security Advisory 2026-005: High Vulnerability in the Linux Kernel (Copy Fail)](https://cert.europa.eu/publications/security-advisories/2026-005/)
- [theori-io/copy-fail-CVE-2026-31431 — official PoC](https://github.com/theori-io/copy-fail-CVE-2026-31431)
- [tgies/copy-fail-c — cross-platform C port of the Copy Fail PoC](https://github.com/tgies/copy-fail-c)
- [NVD CVE-2026-31431](https://nvd.nist.gov/vuln/detail/CVE-2026-31431)
- [Linux mainline commit a664bf3d603d (algif_aead: validate scatterlist before AEAD recvmsg)](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a664bf3d603d)
- [Linux mainline commit fafe0fa2995a (crypto/algif_aead: tighten AAD length checks)](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fafe0fa2995a)
- [Ubuntu USN-7142-1: Linux kernel vulnerability](https://ubuntu.com/security/notices/USN-7142-1)
- [Red Hat RHSA-2026:1812 — kernel security update](https://access.redhat.com/errata/RHSA-2026:1812)
- [Amazon Linux ALAS2023-2026-845](https://alas.aws.amazon.com/AL2023/ALAS-2026-845.html)
- [SUSE SUSE-SU-2026:1431-1](https://www.suse.com/support/update/announcement/2026/suse-su-20261431-1.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0445