About CVE-2026-31431<\/p>\n
According to<\/a> Theori researchers, CVE-2026-31431 originates from the interaction of three reasonable kernel changes made over several years: the addition of authencesn (an AEAD cryptographic wrapper used by IPsec) in 2011, the introduction of AF_ALG AEAD socket support in 2015, and an in-place optimization added to algif_aead.c in 2017.<\/p>\n It\u2019s a logic bug in the authencesn cryptographic template and allows an unprivileged local user to write 4 controlled bytes into the page cache<\/a> of any readable file on a Linux system, and use that to gain root. <\/p>\n The technical write-up<\/a> is more detailed, of course.<\/p>\n The good news is that CVE-2026-31431 exploitation requires local code execution as a regular user, which means that, by itself, it can\u2019t be exploited remotely. But \u201cchain it with anything that gives you that (web RCE landing in an unprivileged service account, an SSH foothold, a malicious PR on a CI runner) and you\u2019re root,\u201d the researchers pointed out.<\/p>\n The bad news is that unlike the Dirty Cow<\/a> and Dirty Pipe<\/a> Linux kernel LPE vulnerabilities, Copy Fail can be exploited without having to win a race condition, and the same exploit will work on many systems.<\/p>\n What to do?<\/p>\n CVE-2026-31431 affects every Linux distribution that uses a kernel that has been released since 2017. <\/p>\n The exploit script is tiny, doesn\u2019t rely on additional software being installed, will work on almost all Linux distributions released since 2017, will work each time it\u2019s run on a vulnerable system, doesn\u2019t change files on disk and won\u2019t be flagged by tools that monitor files for tampering, leaves no forensic trace on disk and, finally, it can break out of container isolation. <\/p>\n For all of these reasons, the researchers advise admins to prioritize patching the vulnerability on multi-tenant Linux systems, CI runners, cloud SaaS running user code, and container clusters first, and then on standard Linux servers and single-user workstations:<\/p>\n CopyFail patching prioritization (Source: Theori)<\/p>\n The researchers verified that Ubuntu 24.04 LTS, Amazon Linux 2023, RHEL 10.1, and SUSE 16 are vulnerable. Openwall Project founder Alexander Peslyak (aka Solar Designer) confirmed<\/a> that the exploit provided worked on Rocky Linux 9.7.<\/p>\n Linux distros have been notified of the existence of the vulnerability in advance, and many have already released kernel packages that include the commit<\/a> that patched it. <\/p>\n Admins\/users who, for whatever reason, can\u2019t update their distribution\u2019s kernel package, can temporarilty mitigate the risk by:<\/p>\n Blocking AF_ALG socket creation via seccomp, or![\"Linux](\"https:\/\/www.newsbeep.com\/nz\/wp-content\/uploads\/2026\/04\/CopyFail-patching-prioritization-1.webp.webp\" "\\"Advice")
<\/a><\/p>\n
\nBlacklisting the algif_aead module.<\/p>\n![](\"https:\/\/www.newsbeep.com\/nz\/wp-content\/uploads\/2025\/10\/1761053168_680_devider.webp.webp\"\/)
<\/p>\n