--- title: CVE-2026-31431 'Copy Fail': Linux kernel crypto flaw... description: CVE-2026-31431, dubbed 'Copy Fail,' is a nine-year-old Linux kernel vulnerability (affecting kernels 4.14–6.19.11) now actively exploited in the wild. The flaw... canonical: https://daily.dev/posts/cve-2026-31431-copy-fail-linux-kernel-crypto-flaw-allows-unprivileged-root-access-bnroujfly twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: CVE-2026-31431 'Copy Fail': Linux kernel crypto flaw allows unprivileged root access | daily.dev og:description: CVE-2026-31431, dubbed 'Copy Fail,' is a nine-year-old Linux kernel vulnerability (affecting kernels 4.14–6.19.11) now actively exploited in the wild. The flaw... og:url: https://daily.dev/posts/cve-2026-31431-copy-fail-linux-kernel-crypto-flaw-allows-unprivileged-root-access-bnroujfly og:image: https://api.daily.dev/og/posts/BNroujFly.png og:image:alt: CVE-2026-31431 'Copy Fail': Linux kernel crypto flaw allows unprivileged root access og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # CVE-2026-31431 'Copy Fail': Linux kernel crypto flaw allows unprivileged root access **[Collections](https://daily.dev/sources/collections)** · 4 min read · 1 upvotes · 0 comments ## Summary CVE-2026-31431, dubbed 'Copy Fail,' is a nine-year-old Linux kernel vulnerability (affecting kernels 4.14–6.19.11) now actively exploited in the wild. The flaw resides in the `algif_aead` module and allows an unprivileged local user to write four controlled bytes into the in-memory page cache of any readable file — including setuid binaries like `sudo` — without modifying the on-disk file, bypassing integrity monitoring. Unlike Dirty Cow or Dirty Pipe, there is no race condition: the exploit is deterministic, requires no kernel offsets, and works via a 732-byte Python script across Ubuntu, RHEL, Debian, Amazon Linux, and SUSE. It also enables container escapes from Kubernetes pods and CI/CD pipeline compromise. CISA has added it to its Known Exploited Vulnerabilities catalog with a federal patch deadline of May 15. Fixed versions are 6.18.22, 6.19.12, and 7.0. Interim mitigation is to disable the `algif_aead` module via modprobe configuration. ## Content ## What happened A nine-year-old bug in the Linux kernel is now being actively exploited in the wild. CISA added CVE-2026-31431, nicknamed "Copy Fail," to its Known Exploited Vulnerabilities catalog after Microsoft Defender observed attackers testing it. Federal civilian agencies have been ordered to patch by May 15. The vulnerability was discovered by researchers at Theori using an AI-assisted pentesting platform called Xint. By their account, a human researcher had the initial hunch about where to look; the AI did the detailed identification work in about an hour. The bug had been sitting in the kernel since 2017. ## The technical details The flaw lives in the `algif_aead` module, part of the kernel's `AF_ALG` crypto interface. A 2017 performance patch introduced in-place AEAD cipher operations that inadvertently allowed file-backed page cache pages to be used as output buffers. The result: an unprivileged local user can use `AF_ALG` sockets and `splice()` to write four controlled bytes into the page cache of any readable file — without touching the file on disk. If those four bytes land on a setuid binary like `sudo`, the attacker gets root. The in-memory copy of the binary is corrupted; the on-disk file is untouched. Integrity monitoring tools that check file hashes see nothing wrong. What makes this particularly nasty compared to predecessors like Dirty Cow or Dirty Pipe: there's no race condition to win. The exploit works on the first attempt, every time, with no kernel offsets or system-specific tuning required. The proof-of-concept is a 732-byte Python script that runs unmodified on Ubuntu 22.04, Ubuntu 24.04, Amazon Linux 2023, RHEL 10.1, SUSE 15.6, SUSE 16, and Debian 12. Affected kernel range: 4.14 through 6.19.11 — essentially every mainstream Linux distribution shipped since 2017. ## Container and cloud exposure This isn't just a bare-metal problem. The exploit enables container escapes from Kubernetes pods, lets attackers compromise multi-tenant hosts, and can be used to inject malicious code into CI/CD pipelines. Shared systems, cloud SaaS environments, and IoT Linux devices are all in scope. The picture is more nuanced for rootless containers. Testing with Podman rootless containers shows that user namespace UID mappings contain the escalation — container root maps to an unprivileged host UID, so the exploit can succeed inside the namespace but gains no host privileges. That said, there's an important caveat: the shared page cache across containers using the same image layers still poses a container-to-container isolation risk even without a full host escape. Running containers with `--security-opt=no-new-privileges`, `--cap-drop=all`, a non-root container user, and a read-only filesystem significantly limits the blast radius. Podman's rootless architecture provides better default isolation than Docker's rootful daemon model here. ## Patches and mitigations Fixed kernel versions: 6.18.22, 6.19.12, and 7.0. Several distributions have issued patches; others are still working through backports. Long-term support kernels (6.12, 6.6, 6.1, 5.15, 5.10) had not received patches as of initial disclosure, and backporting is non-trivial due to API changes. Distributions that have issued updates include Arch Linux, Debian, Ubuntu, SUSE, and Tails (which issued an emergency release updating to kernel 6.12.85). Red Hat initially deferred patching but reversed course. Deepin has also issued an update. Check your distribution's security advisories for current status. **Interim mitigation:** Disable the `algif_aead` module. ```bash # Block the module from loading echo "install algif_aead /bin/false" >> /etc/modprobe.d/disable-algif-aead.conf # If already loaded, unload it modprobe -r algif_aead ``` Ubuntu's security team has also released a `kmod` package update that applies this mitigation automatically. Note that applications relying on hardware-accelerated AEAD cryptography via the kernel interface will fall back to software implementations — most handle this gracefully, but it's worth testing in your environment. Alternatively, `AF_ALG` sockets can be blocked via seccomp policy if your workload allows it. ## Who should prioritize this Anyone running multi-tenant Linux hosts, Kubernetes clusters, CI/CD runners, or cloud infrastructure should treat this as urgent. The exploit requires local access, so it can't be triggered remotely on its own — but it chains well with any vulnerability that gives an attacker a foothold, and CISA has noted it could also be weaponized through supply chain attacks or malicious links. If you can't patch immediately, disable `algif_aead` and monitor for privilege escalation attempts. The fix itself reverts the 2017 in-place optimization that introduced the bug. ## Similar posts on daily.dev - [Copy Fail — CVE-2026-31431](https://daily.dev/posts/copy-fail-cve-2026-31431-ippi6vm9m) · Hacker News · 1 upvotes · 1 comments --- Tags: [#security](https://daily.dev/tags/security), [#linux](https://daily.dev/tags/linux), [#containers](https://daily.dev/tags/containers), [#cryptography](https://daily.dev/tags/cryptography) [View this post on daily.dev](https://daily.dev/posts/cve-2026-31431-copy-fail-linux-kernel-crypto-flaw-allows-unprivileged-root-access-bnroujfly) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"CVE-2026-31431 'Copy Fail': Linux kernel crypto flaw allows unprivileged root access","url":"https://daily.dev/posts/cve-2026-31431-copy-fail-linux-kernel-crypto-flaw-allows-unprivileged-root-access-bnroujfly","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cve-2026-31431-copy-fail-linux-kernel-crypto-flaw-allows-unprivileged-root-access-bnroujfly"},"datePublished":"2026-04-30T09:45:03.930Z","dateModified":"2026-05-05T23:14:42.258Z","description":"CVE-2026-31431, dubbed 'Copy Fail,' is a nine-year-old Linux kernel vulnerability (affecting kernels 4.14–6.19.11) now actively exploited in the wild. The flaw...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/da5444828f707c70107d16cba1ee2b9e?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/da5444828f707c70107d16cba1ee2b9e?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cve-2026-31431-copy-fail-linux-kernel-crypto-flaw-allows-unprivileged-root-access-bnroujfly","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,linux,containers,cryptography","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"CVE-2026-31431 'Copy Fail': Linux kernel crypto flaw allows unprivileged root access"}]} ```