---
title: "Copy Fail: Exploited Linux Kernel Root Exploit Since 2017"
url: https://erroneo.us/security/briefs/copy-fail-linux-kernel-lpe-cve-2026-31431/
description: "CVE-2026-31431 lets any local user become root (and cross containers) on Linux kernels since 2017. In CISA KEV. Fixed in 6.12.85, 6.18.22, 7.0 etc. Patch now."
type: security-brief
section: "Security Digest"
date_published: 2026-04-29
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2026-31431"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Copy Fail: Exploited Linux Kernel Root Exploit Since 2017

**Verdict: Act now.** Any Linux box that runs code from more than one trust level (CI runners, container hosts, shared servers) needs a patched kernel and reboot now; single-user machines can patch on a short cycle.

- **Who must act:** Anyone running Linux kernels 4.14+ without the fix where untrusted or semi-trusted code runs: CI/CD runners, Kubernetes and Docker hosts, multi-user and hosting servers.
- **Who can relax:** Hosts already on fixed stable kernels (5.10.254, 5.15.204, 6.1.170, 6.6.137, 6.12.85, 6.18.22, 6.19.12, 7.0+) or vendor kernels with the backport, after a reboot.
- **Affected:** Linux kernel 4.14 and later without the algif_aead fix (virtually all major distributions shipped since 2017)
- **Fixed:** Linux 5.10.254; 5.15.204; 6.1.170; 6.6.137; 6.12.85; 6.18.22; 6.19.12; 7.0; Distribution kernels carrying upstream commit a664bf3d603d
- **CVEs:** CVE-2026-31431
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Install your distribution's fixed kernel and reboot (uname -r to confirm the running kernel changed)
2. Patch CI runners, container hosts and multi-tenant servers first
3. If you cannot reboot yet and algif_aead is a module: echo 'install algif_aead /bin/false' > /etc/modprobe.d/disable-algif.conf && rmmod algif_aead
4. If algif_aead is built in, add initcall_blacklist=algif_aead_init to the kernel command line and reboot, or block AF_ALG sockets with seccomp for untrusted workloads
5. Test the mitigation for apps that use the kernel crypto API (e.g. cryptsetup) before broad rollout

### How to check if you are affected

- Compare uname -r on every host against your distro's fixed kernel for CVE-2026-31431
- Check whether algif_aead is loaded: lsmod | grep algif_aead
- Hunt for unprivileged processes opening AF_ALG sockets followed by setuid binaries (e.g. su) running with unexpected parents
- Remember the change lives only in page cache: disk hashes stay clean and a reboot erases evidence, so collect memory/process telemetry before rebooting suspect hosts

## What happened

On April 29, 2026, researchers at Theori disclosed **Copy Fail** (**CVE-2026-31431**), a local privilege escalation in the Linux kernel's crypto API. Some outlets give April 30. The bug sits where the `authencesn` AEAD template meets the `algif_aead` socket interface. Per [Help Net Security](https://www.helpnetsecurity.com/2026/04/30/copyfail-linux-lpe-vulnerability-cve-2026-31431/), it lets an unprivileged user write four controlled bytes into the page cache of any file they can read. Point that at a setuid binary such as `/usr/bin/su` and you have root.

Three individually reasonable changes from 2011, 2015 and 2017 combined to create it. The upstream fix, commit a664bf3d603d (referenced in the CVE record), simply reverts `algif_aead` to operating out-of-place. [Tenable reports](https://tenable.com/blog/copy-fail-cve-2026-31431-frequently-asked-questions-about-linux-kernel-privilege-escalation) that Theori's Taeyang Lee reported it on March 23. The patch landed April 1, and the CVE was assigned April 22. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-31431) scores it CVSS 3.1 7.8.

## Who is affected

The CVE record marks kernels from 4.14 onward as affected. Fixed stable releases are 5.10.254, 5.15.204, 6.1.170, 6.6.137, 6.12.85, 6.18.22, 6.19.12 and 7.0. Theori verified the exploit on Ubuntu 24.04 LTS, Amazon Linux 2023, RHEL 10.1 and SUSE 16, and Rocky Linux 9.7 was also confirmed. In practice, that is nearly every mainstream distribution shipped since 2017. Distribution patches arrived unevenly. At disclosure, Help Net Security listed Debian, Ubuntu, AlmaLinux, SUSE, Fedora and CloudLinux as patched while RHEL users were still waiting. Check your vendor's tracker rather than upstream version numbers, because distribution kernels backport fixes.

## Do you really need to act?

For many readers, yes. It is "only" local, but local is cheap in 2026: a CI job, a compromised web app, a container foothold, or an SSH account. [The Hacker News reports](https://thehackernews.com/2026/05/cisa-adds-actively-exploited-linux-root.html) Kaspersky's description of a public 732-byte Python exploit, with Go and Rust ports following. Unlike Dirty COW or Dirty Pipe, it needs no race and works unmodified across distributions. CISA added it to the KEV catalog on May 1, 2026, with a federal deadline of May 15. One outlet dated the addition May 4; the CVE record's KEV entry says May 1. Microsoft initially described only "preliminary testing activity" in the wild, so the scale of real attacks was unclear early on.

Containers raise the stakes. Because the page cache is shared, Tenable and Theori say the exploit can cross container boundaries. Kaspersky notes that Docker, LXC and Kubernetes expose AF_ALG to containers by default when the module is loaded. If you run other people's code on a shared kernel, treat this as urgent. On a personal workstation or a single-purpose VM where every process is yours, a prompt routine kernel update is enough.

## What to do now

1. Install your distribution's fixed kernel and **reboot**. Confirm with `uname -r`.
2. Patch CI runners, Kubernetes and Docker nodes, and shared or hosting servers first.
3. If you must wait and `algif_aead` is a loadable module, use the mitigation Tenable documents: `echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf` then `rmmod algif_aead`.
4. If it is built in (`CONFIG_CRYPTO_USER_API_AEAD=y`), add `initcall_blacklist=algif_aead_init` to the boot parameters and reboot. For untrusted containers, a seccomp profile that denies AF_ALG sockets also works.
5. Test first. Tenable notes that cryptsetup and firefox-esr use this interface, though early testing found no breakage.

## How to tell if you were hit

Exploitation is hard to see. The modification exists only in memory, so file-integrity tools and disk forensics find nothing, and a reboot or memory pressure erases it. The exploit also uses only legitimate syscalls. Your best signals are EDR or audit telemetry showing unprivileged processes creating AF_ALG sockets (`socket(AF_ALG, ...)`), followed shortly by setuid binaries such as `su` running with unusual parents or arguments, or by root shells descending from a low-privilege user or container. Capture process and memory evidence from suspect hosts before rebooting them.

## Timeline

- Mar 23, 2026 — Theori reports the flaw to the kernel security team.
- Apr 1, 2026 — Fix committed upstream.
- Apr 22, 2026 — CVE-2026-31431 assigned.
- Apr 29, 2026 — Public disclosure with working PoC.
- May 1, 2026 — CISA adds the CVE to KEV (federal deadline May 15, 2026).

## Sources

1. [CVE.org — CVE-2026-31431 record (incl. CISA KEV entry)](https://www.cve.org/CVERecord?id=CVE-2026-31431)
2. [Tenable — Copy Fail (CVE-2026-31431) FAQ](https://tenable.com/blog/copy-fail-cve-2026-31431-frequently-asked-questions-about-linux-kernel-privilege-escalation)
3. [Help Net Security — Nine-year-old Linux kernel flaw enables reliable local privilege escalation](https://www.helpnetsecurity.com/2026/04/30/copyfail-linux-lpe-vulnerability-cve-2026-31431/)
4. [The Hacker News — CISA adds actively exploited Linux root flaw](https://thehackernews.com/2026/05/cisa-adds-actively-exploited-linux-root.html)

---
Source page: https://erroneo.us/security/briefs/copy-fail-linux-kernel-lpe-cve-2026-31431/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt