CVE-2026-31431 "Copy Fail": 732 Bytes of Code Breaks the Linux…

A vulnerability in the algif_aead module enables root privilege escalation via a 732-byte exploit. CISA has added CVE-2026-31431 to the KEV catalog with a May 15 deadline.

CISA added CVE-2026-31431 to the Known Exploited Vulnerabilities catalog on May 1, 2026. The flaw in the Linux kernel allows root privilege escalation with an exploit of roughly 732 bytes. The mandatory mitigation deadline under BOD 22-01 is May 15, 2026. The vulnerability, nicknamed "Copy Fail," stems from a 2017 optimization in the kernel's cryptographic subsystem and undermines container isolation in cloud and Kubernetes environments.

Key Takeaways

CERT-EU published advisory 2026-005 on April 29, 2026: the flaw resides in the kernel's algif_aead module, introduced by commit 72548b093ee3 in 2017
The deterministic exploit of roughly 732 bytes, confirmed by Microsoft Security Research, requires no race conditions or special privileges: it writes 4 controlled bytes into the page cache of setuid files in RAM
The CVSS 3.1 score is 7.8 (HIGH) with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, per the official CVE record from kernel.org on NVD
Microsoft and CERT-EU confirm container escape risk: the page cache is shared between host and containers, enabling cross-container escalation without modifying on-disk files

The Mechanism: When Optimization Becomes a Weapon

The problem originates in the algif_aead module, part of the kernel's cryptographic subsystem that exposes authenticated encryption algorithms via AF_ALG sockets. In 2017, commit 72548b093ee3 introduced an in-place optimization to reduce memory copies during crypto operations: instead of allocating separate buffers for data and authentication tags, the code reuses the same memory pages.

According to CERT-EU's analysis, this optimization combines dangerously with the splice() syscall, designed to move data between file descriptors without copying to userspace. An unprivileged user can create an AF_ALG socket, configure it for AEAD operations, and use splice() to transfer data such that the kernel writes 4 arbitrary bytes into a page-cache page associated with a readable file.

The natural target is a setuid executable like /usr/bin/su: corrupting its in-RAM representation yields a root shell without ever touching on-disk content. This bypasses filesystem integrity checks based on hashing.

"By chaining an AF_ALG socket operation with splice(), an unprivileged local user can perform a controlled 4-byte write to an arbitrary page-cache-backed page, targeting a setuid binary such as /usr/bin/su to obtain a root shell" — CERT-EU advisory 2026-005

Discovery and Fix: Nine Years of Latency

The upstream fix commit a664bf3d603d, dated April 1, 2026, does not correct the logic; it reverts the optimization entirely, abandoning the 2017 change. The original researcher, cited as "Xint" by CloudLinux and generically as "researcher" by CERT-EU, demonstrated that the vector is deterministic and reproducible across distributions.

Microsoft Security Research verified that the exploit "does not depend on race conditions" and can be implemented in "a very small script (~732 bytes) that works across multiple distributions." The company documented detections via Microsoft Defender XDR across its product ecosystem.

IlSoftware.it reports that CISA cited "real-world exploitation activity" as the basis for KEV inclusion. The editorial brief does not clarify whether this refers to confirmed in-production attacks or published PoCs demonstrated as active: CISA's wording could represent a preventive signal rather than confirmation of verified field exploitation.

Impact on Containers and Multi-Tenant Cloud

The critical dimension of CVE-2026-31431 is the containerized context. In Docker, LXC, and Kubernetes infrastructures, containers share the kernel with the host and with each other. The page cache is one of the shared memory mechanisms: when a container reads a file already loaded by the host, the kernel reuses the same physical pages.

Microsoft explicitly describes this scenario: "Because the page cache is shared across containers and the host, the vulnerability also enables cross-container impacts and container escape scenarios." A compromised container with unprivileged user access can corrupt the page cache of a host setuid executable, gaining root on the entire node without escaping its namespace.

This directly threatens multi-tenant environments: Kubernetes clusters with untrusted workloads, shared CI/CD runners, cloud development platforms, and container hosting services. The absence of special privileges inside the container makes mitigation via internal security policies impractical.

Patch Status and Availability as of April 30, 2026

CERT-EU's patch availability table as of April 30, 2026 showed a fragmented landscape. CloudLinux had already released kernel patches and KernelCare livepatches for CL7h, CL8, CL9, and CL10. Ubuntu 26.04 and later were explicitly unaffected. For Red Hat and other major distributions, status was marked "unknown" or pending.

The dossier does not specify the current status (May–June 2026) of patches for non-CloudLinux distributions, leaving an operational uncertainty gap for administrators managing systems with more conservative update cycles.

What to Do Now

Converging advisories indicate four priority action lines:

Update the kernel to versions that include commit a664bf3d603d, verifying availability with your distribution vendor
Apply livepatches where available: CloudLinux has already shipped KernelCare for supported versions
Disable the algif_aead module as a temporary mitigation on systems where the patch is not yet available
Block AF_ALG via seccomp in container profiles to reduce attack surface, acknowledging this measure does not fully eliminate host-level risk

The CISA deadline of May 15, 2026 demands rapid action for US federal agencies covered by BOD 22-01. Private organizations should calibrate priority based on container exposure and their environment's threat profile.

Why This Case Is Different

CVE-2026-31431 is not a misconfiguration or a marginal implementation bug. It is an architectural vulnerability: a legitimate 2017 memory optimization that, combined with an existing syscall, produces a catastrophic side effect. Its deterministic nature — no race conditions, no brute force, 732 bytes of code — eliminates traditional exploitation barriers.

The exposure window, from 2017 to April 1, 2026, raises questions about kernel code review practices for optimizations that alter the memory security model. The fact that the fix is a simple revert, not a surgical correction, suggests the optimization itself is inherently incompatible with the isolation guarantees the kernel must provide.

For security operators, the lesson is measurable: nine years of latency, an exploit under one kilobyte, and a KEV catalog imposing two weeks of operational margin. The combination of technical simplicity, container impact, and regulatory urgency makes this case a reference point for kernel risk assessment in upcoming planning cycles.

Information verified against cited sources and current as of publication.

Sources

Sources and references