CVE-2026-31431 (Copy Fail): Linux Kernel LPE

A new Linux kernel LPE disclosed by Theori/Xint lets any unprivileged local user become root with a 732-byte Python script. Works first try, no race, no per-kernel offsets. CVSS 7.8 (High), effectively critical for shared-kernel and multi-tenant environments.

The bug

A logic flaw in the kernel’s algif_aead (introduced in 4.14, July 2017), reached via AF_ALG and splice(), gives a deterministic 4-byte write into the page cache of any readable file, including setuid binaries.

• No race, no per-kernel offsets, works first try.
• On-disk file is unchanged, so file-integrity tools won’t catch it.
• Page cache is shared across the host, making this a container escape primitive on Kubernetes nodes from any pod that can create AF_ALG sockets.

Who’s affected

Every kernel from 4.14 until the fix. Theori verified root on Ubuntu 24.04 LTS, Amazon Linux 2023, RHEL 10.1, and SUSE 16. The same exploit works unmodified on Debian, Fedora, Rocky, Alma, Oracle, Arch. Fixed in 6.18.22, 6.19.12, and 7.0.

What to do

Most distros had not shipped patched kernels at disclosure. Mitigate first, patch when available.

1. Disable algif_aead on every host:

echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf rmmod algif_aead 2>/dev/null || true

Safe to apply: does not affect dm-crypt, kTLS, IPsec, OpenSSL, SSH, or kernel keyring crypto. Only impacts apps explicitly using the OpenSSL afalg engine.

2. Block AF_ALG via seccomp for untrusted workloads, such as K8s pods, CI runners, and agent sandboxes.
   
3. Patch the kernel as soon as your distro ships the fix, then reboot.
   
4. Prioritize: multi-tenant K8s nodes, then CI runners, then production servers, then workstations.

For cloud-native teams

Kernel CVEs don’t appear in image SBOMs, so detection belongs at the node layer. Workloads running under hardware virtualization (Firecracker for Lambda, Fargate) or kernel reimplementations (gVisor, V8 isolates) are not exposed to the host kernel’s AF_ALG path.

References

• https://copy.fail/
• https://xint.io/blog/copy-fail-linux-distributions
• https://www.openwall.com/lists/oss-security/2026/04/29/23
• https://nvd.nist.gov/vuln/detail/CVE-2026-31431