Nine-year-old Linux kernel flaw enables reliable local privilege escalation (CVE-2026-31431)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-31431 | Local Privilege Escalation (Copy Fail) in Linux Kernel algif_aead Interface CVE-2026-31431 ('Copy Fail') is an incorrect resource transfer between spheres (CWE-669/CWE-1288) in the Linux kernel's algif_aead implementation of the AF_ALG userspace crypto interface, introduced roughly nine years ago (around 2017, per public reporting) when commit 72548b093ee3 switched AEAD operations to in-place handling even though the source and destination buffers come from different mappings. A local, unprivileged user can trigger the flaw by performing AEAD operations through the AF_ALG socket interface, causing the kernel to mishandle the copy of ciphertext and associated data. Successful exploitation provides a reliable local privilege escalation to root (C:H/I:H/A:H per the CVSS vector). Nearly every major Linux distribution and enterprise platform is exposed, including the kernel itself, Red Hat Enterprise Linux (including AUS, EUS, TUS and Update Services for SAP Solutions), OpenShift Container Platform, Amazon Linux, Ubuntu, Debian, openSUSE Leap, SUSE CaaS Platform, NixOS, and Linux-based products from Arista and Siemens. The flaw has public proof-of-concept code, a 99.9% EPSS score, and was added to CISA's Known Exploited Vulnerabilities catalog on 2026-05-01, indicating exploitation in the wild (ransomware use is unknown). Do: Patch by installing the kernel update for CVE-2026-31431 through your distribution's security channel (Red Hat Enterprise Linux including AUS/EUS/TUS/SAP channels, OpenShift, Amazon Linux, Ubuntu, Debian, openSUSE Leap, SUSE CaaS Platform, NixOS, and Arista/Siemens firmware/software as applicable) and reboot into the patched kernel; the data provides no fixed version numbers, so defer to vendor advisories. Because the flaw is in CISA's KEV catalog (added 2026-05-01) with a 99.9% EPSS score, prioritize internet-reachable and multi-user systems first and follow BOD 22-01 guidance for cloud services. Check running kernel versions ('uname -r') and distribution advisory status to confirm you are on a fixed build. | 7.8 | 100% | KEV PoC ×5 |
| masshundreds of millions to billions of installations (servers, cloud instances, desktops, and Android/embedded devices running affected kernel generations) |
Full article528 words · extracted from helpnetsecurity.com · click to collapse
Security researchers at Theori have disclosed a high-severity local privilege escalation (LPE) vulnerability (CVE-2026-31431) in the Linux kernel.
The flaw, nicknamed “Copy Fail”, has affected virtually every major Linux distribution shipped since 2017, and a working proof-of-concept (PoC) exploit is publicly available.
About CVE-2026-31431
According to Theori researchers, CVE-2026-31431 originates from the interaction of three reasonable kernel changes made over several years: the addition of authencesn (an AEAD cryptographic wrapper used by IPsec) in 2011, the introduction of AF_ALG AEAD socket support in 2015, and an in-place optimization added to algif_aead.c in 2017.
It’s a logic bug in the authencesn cryptographic template and allows an unprivileged local user to write 4 controlled bytes into the page cache of any readable file on a Linux system, and use that to gain root.
The technical write-up is more detailed, of course.
The good news is that CVE-2026-31431 exploitation requires local code execution as a regular user, which means that, by itself, it can’t be exploited remotely. But “chain it with anything that gives you that (web RCE landing in an unprivileged service account, an SSH foothold, a malicious PR on a CI runner) and you’re root,” the researchers pointed out.
The bad news is that unlike the Dirty Cow and Dirty Pipe Linux kernel LPE vulnerabilities, Copy Fail can be exploited without having to win a race condition, and the same exploit will work on many systems.
What to do?
CVE-2026-31431 affects every Linux distribution that uses a kernel that has been released since 2017.
The exploit script is tiny, doesn’t rely on additional software being installed, will work on almost all Linux distributions released since 2017, will work each time it’s run on a vulnerable system, doesn’t change files on disk and won’t be flagged by tools that monitor files for tampering, leaves no forensic trace on disk and, finally, it can break out of container isolation.
For all of these reasons, the researchers advise admins to prioritize patching the vulnerability on multi-tenant Linux systems, CI runners, cloud SaaS running user code, and container clusters first, and then on standard Linux servers and single-user workstations:
Copy Fail patching prioritization (Source: Theori)
The researchers verified that Ubuntu 24.04 LTS, Amazon Linux 2023, RHEL 10.1, and SUSE 16 are vulnerable. Openwall Project founder Alexander Peslyak (aka Solar Designer) confirmed that the exploit provided worked on Rocky Linux 9.7.
Linux distros have been notified of the existence of the vulnerability in advance, they say, and some have already released kernel packages that include the commit that patched it.
Admins/users who, for whatever reason, can’t update their distribution’s kernel package, can temporarilty mitigate the risk by:
- Blocking AF_ALG socket creation via seccomp, or
- Blacklisting the algif_aead module.
UPDATE (May 4, 2026, 09:25 a.m. ET):
CISA has added Copy Fail to its Known Exploited Vulnerabilities catalog and ordered US federal civilian agencies to address it by May 15, 2026.
Patches are available for Debian, Ubuntu, AlmaLinux, SUSE, Fedora and CloudLinux users, while RHEL users are still waiting.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2026/04/30/copyfail-linux-lpe-vulnerability-cve-2026-31431/