Fixes available for CVE-2026-31431 (Copy Fail) Linux Kernel Local Privilege Escalation Vulnerability | Ubuntu

What it is

CVE-2026-31431 ("Copy Fail"), a HIGH-severity (CVSS 3.1 = 7.8) local privilege escalation in the Linux kernel's algif_aead module, publicly disclosed April 29, 2026. It affects all Ubuntu releases before Resolute (26.04). Fixed kernel packages are now available, and the temporary kmod mitigation Ubuntu shipped on disclosure day is being reverted.

Preconditions / Affected

Any Ubuntu release before 26.04 running a vulnerable kernel with the algif_aead module loadable. On hosts without container workloads a local user gets root — a working exploit is already published. On container hosts running potentially-malicious workloads it may enable container escape, though no PoC for that path exists yet.

What to do

The permanent fix is a kernel upgrade plus reboot — not just the mitigation. Order matters: upgrade the kernel, then let the reverted kmod package re-enable the module.

Check what you're running:

uname -r
dpkg -l 'linux-image*' | grep ^ii
dpkg -l kmod

Upgrade everything and reboot:

sudo apt update && sudo apt upgrade
sudo reboot

If a full upgrade isn't possible and the kernel came via a meta package:

sudo apt update
dpkg-query -W -f '${source:Package}\t${binary:Package}\n' | awk '$1 ~ "^linux-meta" { print $2 }' | xargs sudo apt install --only-upgrade

unattended-upgrades (default on 16.04 LTS onward) will apply the patch within 24 hours, but a reboot is still required.

If you cannot patch or take the kmod mitigation, disable the module manually:

echo "install algif_aead /bin/false" | sudo tee /etc/modprobe.d/manual-disable-algif_aead.conf
sudo rmmod algif_aead 2>/dev/null
grep -qE '^algif_aead ' /proc/modules && echo "Affected module is loaded" || echo "Affected module is NOT loaded"

Reboot if the module is in use and won't unload. To remove the kmod mitigation later (e.g. app compatibility), comment out its config and reboot:

sudo sed -i 's/^/#/' /etc/modprobe.d/disable-algif_aead.conf
sudo reboot

Caveats

The mitigation disables hardware-accelerated crypto. Applications are expected to fall back to userspace crypto, but the page warns some may lack that fallback; already-running apps may misbehave until a reboot triggers it. Note the two config filenames differ — the manual step writes manual-disable-algif_aead.conf, while the disable-mitigation step edits disable-algif_aead.conf (the kmod-installed file).