CVE-2026-31431, dubbed 'Copy Fail' (CVSS 7.8), is a Linux kernel local privilege escalation flaw in the algif_aead userspace crypto interface, present since a 2017 in-place optimization commit. An unprivileged local user can corrupt the page cache backing setuid binaries (e.g., /usr/bin/su) via AF_ALG sockets and splice(), gaining root in seconds. Working exploits exist for Ubuntu 24.04, Amazon Linux 2023, RHEL 10.1, and SUSE 16. The public PoC is a ~700-byte Python script chaining three syscalls. Unlike Dirty Pipe, this is a straight-line logic flaw with no race conditions. Fixes are available in Linux 7.0, 6.19.12, and 6.18.22. Mitigations include patching, restricting AF_ALG socket creation via seccomp, and deploying the provided Falco detection rule.
