Copy Fail CVE-2026-31431: Root Escalation in 732 Bytes on Linux

CVE-2026-31431 lets a local user gain root on Linux in seconds with a 732-byte script. CISA confirms active exploitation.

On April 29, 2026, CERT-EU coordinated the public disclosure of CVE-2026-31431, a Linux kernel vulnerability that allows any unprivileged process to obtain root in seconds. On May 1, CISA added it to the KEV catalog, confirming active exploitation. The flaw resides in the AF_ALG cryptographic subsystem and exploits an in-place optimization introduced in 2017 to write four attacker-controlled bytes into the page cache of readable files, with impacts extending beyond a single system.

Key Takeaways

CVE-2026-31431 carries a CVSS 7.8 HIGH rating per NVD and CVE.org: a local user without special privileges gains root on Linux kernels from 4.14 through 7.0-rc
The exploit script measures roughly 732 bytes, is deterministic, requires no race condition, and works cross-distribution according to Microsoft
The mechanism exploits the AF_ALG cryptographic subsystem: a 2017 in-place optimization permits controlled 4-byte writes into the page cache of readable files
CISA added the vulnerability to the KEV catalog on May 1, 2026, with two dates set for May 15; Microsoft confirms limited active exploitation

The Mechanism: 4 Bytes to Corrupt the Page Cache

The flaw lies in algif_aead, a module of the Linux kernel's AF_ALG cryptographic subsystem. In 2017, an in-place optimization was introduced that reuses source memory as the destination in cryptographic operations. When the splice() syscall copies data into an AF_ALG socket and a copy error occurs, the kernel writes four user-controlled bytes into the page cache of a readable file, bypassing access permissions.

The page cache is the shared memory where the kernel keeps RAM copies of recently read files. Corrupting the page cache of a setuid binary such as /usr/bin/su allows altering executing code without modifying the file on disk. According to the Microsoft Security Response Center, the exploit is "deterministic, does not depend on race conditions, and can be implemented in a very small script (~732 bytes) that works across distributions."

"An unprivileged local user can write four controlled bytes into the page cache of any readable file on a Linux system and use them to gain root" — Theori/Xint research team, via The Hacker News

Portability and Exploit Characteristics

The vulnerability exhibits properties that make it particularly concerning for security teams. According to a Xint.io spokesperson quoted by The Hacker News, "this vulnerability is unique because it has four properties that almost never appear together: it is portable, tiny, stealthy, and cross-container." The simplicity of the mechanism drastically lowers the attack threshold: no advanced reverse-engineering skills or timing-based race conditions are required.

David Brumley of Bugcrowd, quoted by The Hacker News, characterized the flaw as a page-cache write primitive applied to a new subsystem. The result is an exploit that works consistently across different distributions and kernel versions, without needing target-specific adaptations.

Cross-Container and Cloud: The Hidden Danger

Microsoft highlighted a specific impact for containerized environments: "Because the page cache is shared between containers and host, the vulnerability also enables cross-container impacts and container escape scenarios." In a multi-tenant environment where distinct containers run isolated workloads on a shared kernel, an unprivileged process inside a single container can compromise the entire node.

The risk profile is maximized in CI/CD pipelines that run untrusted code in ephemeral containers, and in cloud services offering shared execution environments. The affected kernel range spans from version 4.14 (still present in embedded and industrial systems) through release candidates of 7.0, with official patches available for LTS branches 5.10.254, 5.15.204, 6.1.170, 6.6.137, 6.12.85, 6.18.22, 6.19.12, and 7.0-rc.

What to Do Now

Verify the kernel version in use and apply updates released by supported distributions: Ubuntu, RHEL, Debian, SUSE, Amazon Linux, Fedora, and Arch Linux have published specific patches according to Microsoft and the Arch Linux advisory
For container and multi-tenant environments, plan node reboots to activate the updated kernel: the shared page cache makes container-level isolation insufficient
Consult the CISA KEV catalog for CVE-2026-31431 and assess remediation timelines based on the May 15, 2026 date indicated for patch application
Review the need to expose AF_ALG access to untrusted containers: if userspace cryptographic functionality is not required, restricting the AF_ALG socket reduces the attack surface

The Upstream Fix and Implications

The upstream fix for Copy Fail consists of reverting to out-of-place operation, essentially undoing the 2017 commit: a conservative solution that prioritizes security over performance. The CVE.org record indicates the patch "reverts to operating out-of-place" and "largely reverts commit 72548b093ee3."

The dossier does not specify whether broader architectural reviews of the splice subsystem are underway, nor how many systems remain unpatched as of late August 2026. The extent of active exploitation documented by Microsoft remains limited to preliminary testing, but inclusion in the CISA KEV catalog indicates federal agencies consider the threat concrete and worthy of priority remediation.

Information has been verified against cited sources and is current as of publication.

Sources

Sources and references