CVE-2026-31431 "Copy Fail" — Linux Kernel algif_aead Deterministic Local Privilege Escalation Affecting All Major Distributions — Threadlinqs Intelligence
As of 2026-05-30, CVE-2026-31431 "Copy Fail" — Linux Kernel algif_aead Deterministic Local Privilege Escalation Affecting All Major Distributions is a high-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 17 indicators of compromise.
Threat ID: TL-2026-0486 · Severity: HIGH · CVSS: 7.8 · Status: ACTIVE · Category: VULNERABILITY
CVE-2026-31431 ("Copy Fail") is a deterministic logic flaw in the Linux kernel's algif_aead module (AF_ALG crypto interface, authencesn algorithm) that lets an unprivileged local user escalate to UID
## Overview
CVE-2026-31431, publicly named "Copy Fail", is a high-severity local privilege escalation vulnerability in the Linux kernel crypto subsystem disclosed on the oss-security mailing list on 2026-04-29 and analyzed in detail by Unit 42 (Palo Alto Networks) on 2026-05-05. The vulnerability is a deterministic four-byte arbitrary write into the kernel page cache reachable from any unprivileged local user via the AF_ALG socket interface. Unlike heap-grooming or race-condition LPEs, exploitation is deterministic — no retries, no offset guessing, 100% reliability on first attempt — and the public 732-byte Python proof-of-concept is portable across distributions without modification.
## Technical Root Cause
The Linux kernel exposes its hardware-accelerated crypto primitives to userspace through the AF_ALG socket family. Submodules like algif_skcipher, algif_aead, and algif_hash provide socket-based APIs to symmetric ciphers, AEAD modes, and hash algorithms. The `algif_aead` driver implements the AEAD (Authenticated Encryption with Associated Data) interface used by algorithms such as `gcm(aes)`, `ccm(aes)`, and the legacy ESN variant `authencesn(...)`.
In 2017, kernel commit `72548b093ee3` ("crypto: algif_aead - skip SGL entries with NULL page") introduced an "in-place" optimization for the `authencesn` algorithm path that allowed encryption to operate directly on user-supplied scatterlist memory rather than allocating an intermediate destination buffer. The optimization assumed that the source and destination pages were always private to the calling task and writable. That assumption is wrong: user pages submitted via `sendmsg(MSG_MORE)` may be shared, read-only, or — critically — backed by the kernel page cache (e.g. mmaps of files on tmpfs, executables, or shared libraries).
When the AEAD authentication tag (the trailing 16 bytes of the ciphertext, of which only four bytes are within the attacker-controlled associated-data length boundary on the ESN variant) is written back "in place", the kernel writes attacker-chosen bytes into a page-cache page belonging to a kernel-trusted file. Because the page cache is shared across all processes that map the same inode, the corruption is visible to every subsequent reader — including the kernel's binfmt loader.
## Exploitation Chain
1. **Setup** — The attacker opens an `AF_ALG` socket, binds it with `sockaddr_alg.salg_type = "aead"` and `salg_name = "authencesn(hmac(sha1),cbc(aes))"`, sets a key with `setsockopt(SOL_ALG, ALG_SET_KEY, ...)`, and `accept()`s a child socket for the operation handle.
2. **Cache Hydrate** — The attacker reads `/usr/bin/su` (or `sudo`/`passwd`) so the relevant page is loaded into the page cache, then `mmap`s the file `MAP_SHARED | PROT_READ`.
3. **Submit** — The attacker calls `sendmsg(MSG_MORE)` on the AEAD socket with the mmap'd page as the source iovec, supplying an attacker-chosen four-byte tag value and the precise associated-data length that will steer the in-place write to the offset of the setuid check inside the binary.
4. **Trigger** — A single read on the operation socket triggers the kernel to perform the encrypt-and-tag operation. The four-byte tag is written into the page-cache page covering `/usr/bin/su`.
5. **Escalate** — The attacker `exec`s `/usr/bin/su`. The loader maps the corrupted page-cache copy. The patched bytes neutralize the credential check, and the binary preserves its setuid-root file mode — the attacker now has UID 0.
6. **Cleanup** — Page-cache eviction (memory pressure or `echo 1 > /proc/sys/vm/drop_caches`) restores the on-disk copy. There is no forensic artifact on disk; only volatile memory carries evidence of the modification.
## Why It Is Deterministic
Copy Fail does not rely on a heap spray, a TOCTOU race, or KASLR brute-force. The page-cache offset of any setuid binary is trivially derivable from `/proc/[pid]/maps` (no privilege required) and the algif_aead in-place path follows a fully deterministic contro
Weaknesses (CWE)
CWE-787, CWE-119, CWE-269, CWE-264
Target sectors: technology, cloud-services, financial, government, healthcare, telecommunications, education, manufacturing, media, saas, fintech, container-platforms
Target regions: Global
Detections & IOCs
As of 2026-07-27, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 17 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, CVE-2026-31431, T1068, T1611, T1548, T1548.001, T1548.003, T1059, T1059.006, T1059.004, T1574, T1620