Skip to content

Back to the catalog

Copy Fail (CVE-2026-31431): Universal Linux Local Privilege Escalation Vulnerability
wiz.ioadvisory

Copy Fail (CVE-2026-31431): Universal Linux Local Privilege Escalation Vulnerability

Wiz's analysis of CVE-2026-31431 ("Copy Fail"), a logic flaw in the Linux kernel's AEAD crypto implementation (algif_aead) that, when chained with AF_ALG sockets and splice(), lets an unprivileged local user write 4 controlled bytes into the page cache of any readable file — including setuid binaries like /usr/bin/su — to gain root. It affects nearly all kernels built since 2017, also enables container escape between co-located containers sharing a base image, and the post covers patch status, seccomp-based mitigation, and detection heuristics (delayed AF_ALG loading, malformed su auth.log entries).

TL;DR CVE-2026-31431 "Copy Fail" lets a local Linux user corrupt page-cache binaries via AF_ALG/algif_aead to escalate to root — Wiz covers exploitation, patching, and detection.
Open original ↗
Document

What it is

CVE-2026-31431 ("Copy Fail"), a Linux kernel local privilege escalation discovered by Xint. The existing summary covers the mechanism (algif_aead scatter-gather flaw chained with AF_ALG + splice() to write 4 bytes into any readable file's page cache) and container-escape scenario. What the summary omits: the patch identifier, the concrete detection signals, and the ordering/caveats that decide whether those signals fire.

Preconditions / Affected

Linux kernel versions built between 2017 and the 2026 patch. As of May 1, 2026, upstream is fixed but many distributions had not shipped patches.

What to do

Update to a kernel including mainline commit a664bf3d603d. Until distro patches land, block AF_ALG socket creation via seccomp policy (the page warns this is not equally effective across distros).

Triage priority: hosts that execute untrusted external code — multi-tenant production services and CI runners on public repos — and hosts holding sensitive secrets or high environment privileges.

Detection signals

Three, each with a stated limit:

  • Delayed AF_ALG loading. Known PoCs trigger NET: Registered PF_ALG protocol family in kern.log/syslog. This is normal at boot and on legitimate on-demand load, but on-demand loading ~300+ seconds after boot was only observed after the CVE went public — so late loading is the suspicious variant, not loading itself.
  • Malformed su auth.log entries. A page-cache-modified /usr/bin/su can produce records missing the invoking username (caller identity unresolved). Compare before/after from the page: `` su[1765]: (to root) alice on pts/1 su[1781]: (to root) on pts/1 ``
  • Network IOC. Alert on curl to https://copy.fail/exp (Xint's PoC host) — only catches non-stealthy attackers.

Caveats

The auth.log signal is path-specific: the more common Theori PoC corrupts /usr/bin/su so PAM/logging never runs, yielding no auth.log entry rather than a malformed one — so absence does not rule out compromise. Wiz states the detection section is deliberately incomplete and biased toward early-PoC behavior; new exploit variants are expected to evade these initial methods. Treat all three signals as correlation inputs, not standalone detections.

Organisations named here

  • Theori
  • Xint

CVEs named here

  • CVE-2026-31431

Technologies named here

  • Wiz Threat Intel Center
  • Linux kernel
  • seccomp
  • Linux
  • Wiz

Techniques named here

  • Page cache modification via algif_aead scatter-gather flaw
  • Container escape via shared base image

Related in Offensive Security