VULNpocalypse
HighVulnerabilityPatch available

Linux “Copy Fail” CVE-2026-31431: a 732-byte exploit turns any local user into root on most distributions since 2017

A kernel crypto bug lets any local user overwrite cached setuid binaries and get root, including from containers. Patch the kernel or disable algif_aead.

Published
Updated
Fixed in
Linux 5.10.254, 5.15.204, 6.1.170, 6.6.137, 6.12.85, 6.18.22, 6.19.12, 7.0; distribution kernels per vendor
Exploitation
Yes. In CISA KEV since 1 May 2026; Microsoft saw limited activity, mostly proof-of-concept testing, with public exploits in Python, Go and Rust

Live scores

CVE-2026-31431
EPSS
0.981
very likely to be attacked soon
VEDAS
0.987
strong exploit evidence
On CISA KEV
Yes, since 2026-05-01
Detection rule
Out of scope (local)
EPSS (chance of attack)
100.1CVE-2026-31431 EPSS over time2026-082026-11-01
VEDAS (exploit evidence)
100.9CVE-2026-31431 VEDAS over time2026-082026-11-01

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.

What happened

“Copy Fail” is a logic bug in algif_aead, part of the Linux kernel’s AF_ALG interface that lets user programs call kernel crypto. A 2017 change (commit 72548b093ee3) made AEAD operations work “in place”, reusing source memory as the destination. By combining AF_ALG with splice() and a failed copy, an unprivileged user gets “a controlled 4-byte write into the kernel’s page cache” of any file they can read (Microsoft; CERT-EU).

Pointing that write at a setuid binary such as /usr/bin/su changes the copy the kernel runs, without touching the file on disk, and gives a root shell. The exploit is about 732 bytes of Python, uses only standard kernel interfaces, and needs no race condition or address guessing (Microsoft; The Hacker News). It is rated CVSS 7.8.

Timeline:

  • 1 April 2026: upstream fix committed (a664bf3d603d), which reverts the 2017 optimisation (CERT-EU).
  • 22 April: CVE published (CVE record).
  • 29 April: public disclosure with a proof-of-concept exploit, at copy.fail. As of 30 April, Ubuntu, Amazon Linux 2023 and SUSE had no fixed package (CERT-EU).
  • 1 May: CISA added it to KEV with a deadline of 15 May (CISA KEV). Microsoft said activity so far was limited and “primarily observed in proof-of-concept testing” (Microsoft). Go and Rust ports of the exploit followed (The Hacker News).

Containers do not stop it. Containers share the host kernel and its page cache. The exploit needs no root inside the container, no kernel modules and no network access (Microsoft). Kaspersky notes that Docker, LXC and Kubernetes give container processes access to AF_ALG by default (The Hacker News).

Am I affected?

Kernels from 4.14 up to the fixed stable releases are affected (CVE record). CERT-EU confirmed it on Ubuntu 24.04 (6.17.0-1007-aws), Amazon Linux 2023 (6.18.8-9.213.amzn2023), RHEL 10.1 (6.12.0-124.45.1.el10_1) and SUSE 16 (6.12.0-160000.9-default). Ubuntu 26.04 and later kernels are not affected (CERT-EU). Distribution kernels carry backports, so check your vendor’s advisory for the fixed package rather than comparing upstream numbers.

bash
# Running kernel version (compare with your distro's fixed package)
uname -r

# Is algif_aead loaded, and is it a module or built in?
lsmod | grep algif_aead
grep CONFIG_CRYPTO_USER_API_AEAD /boot/config-$(uname -r)

# Anything currently using AF_ALG sockets?
lsof | grep AF_ALG

If CONFIG_CRYPTO_USER_API_AEAD=y, the code is built into the kernel and the module workaround below will not remove it; you need the patched kernel.

Detection is hard because the exploit uses only legitimate system calls (The Hacker News). Microsoft Defender detects the public exploits as Exploit:Linux/CopyFailExpDl.A, Exploit:Python/CopyFail.A, Exploit:Linux/CVE-2026-31431.A and Behavior:Linux/CVE-2026-31431 (Microsoft).

What to do now

  1. Patch and reboot the riskiest hosts first: CI/CD runners, Kubernetes nodes and shared build hosts that run code you do not fully trust (CERT-EU). Use your distribution’s fixed kernel package; upstream fixes are in 5.10.254, 5.15.204, 6.1.170, 6.6.137, 6.12.85, 6.18.22, 6.19.12 and 7.0 (CVE record). Rebuild node images and runner AMIs so new nodes do not start on old kernels.
  2. Until you can reboot, disable algif_aead: run echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf, then rmmod algif_aead (CERT-EU). CERT-EU says this may break applications configured to use OpenSSL’s afalg engine or that open aead sockets directly. dm-crypt and LUKS, kTLS, IPsec, OpenSSL, GnuTLS, NSS and SSH are not affected.
  3. Block AF_ALG socket creation in container seccomp profiles for Docker, Podman and Kubernetes workloads, whatever the patch state (CERT-EU).
  4. Recycle nodes after a container compromise. Microsoft advises treating any container code execution as a potential host compromise on unpatched kernels (Microsoft). Because the change is only in memory, a reboot clears a tampered setuid binary but not anything the attacker did as root.

Sources