Linux Kernel Zero‑Day CVE‑2026‑31431: How a Deterministic Logic Flaw Lets Any User Become Root

Security researchers have recently unmasked a critical zero-day vulnerability within the Linux kernel, aptly named “Copy Fail” (CVE-2026-31431). This is not your typical noisy exploit; it is a surgical strike that allows unprivileged local users to escalate their privileges to absolute root access.

What makes this discovery particularly unsettling is the efficiency of the attack: a mere 732-byte Python script is all that is required to compromise major Linux distributions that have been running since 2017.

To understand the gravity of Copy Fail, it is helpful to compare it to historical milestones like Dirty COW. While Dirty COW relied on complex race conditions—often leading to system instability or crashes if the timing wasn’t perfect—Copy Fail is a deterministic logic flaw. It doesn’t require luck, specific timing windows, or repeated retries. It works every single time, making it both highly reliable and incredibly portable across various hardware architectures.

Perhaps more concerning is its stealth profile. The exploit operates entirely within the in-memory page cache. Because it manipulates the cached version of a file rather than the physical bits on the storage medium, the kernel’s writeback machinery never flags the page as “dirty.” Consequently, standard File Integrity Monitoring (FIM) tools that rely on on-disk checksums will see absolutely nothing wrong, allowing the exploit to hide in plain sight.

The Mechanics: How the Exploit Works

The vulnerability emerges from a perfect storm of three interacting kernel subsystems: the AF_ALG socket type, the splice system call, and the implementation of authenticated cryptographic templates.

The AF_ALG interface is designed to expose the kernel’s internal cryptographic functions to userspace. The vulnerability is triggered when an attacker uses the splice system call to move data from a file directly into an AF_ALG socket. Due to a kernel optimization introduced in 2017, the system began performing cryptographic operations “in-place” to save memory, essentially using the same memory buffer for both the input data and the resulting output.

The flaw resides in the authencesn algorithm. During processing, the algorithm inadvertently utilizes the output boundary as a temporary “scratch pad,” writing 4 bytes beyond the intended memory limit. This 4-byte overflow allows an attacker to perform a controlled overwrite of the page cache for any readable file. By targeting a critical setuid-root binary (the mechanism used for user switching), an attacker can inject a small piece of shellcode into the cached executable, granting them immediate root privileges upon the next execution.

The blast radius of Copy Fail is extensive. It affects backbone distributions including Ubuntu, Amazon Linux, Red Hat Enterprise Linux (RHEL), and SUSE. Because the page cache is a shared global resource, this is not just a local escalation risk; it functions as a potent container escape primitive. An attacker who compromises a single container can potentially bypass isolation layers to compromise the entire underlying Kubernetes node.

Remarkably, this bug has lived in the kernel since version 4.14, remaining undetected for nearly a decade. It was only brought to light through sophisticated, AI-assisted code review by researchers at Theori and Xint Code.

Remediation and Mitigation

The good news is that a fix is available. Linux kernel maintainers have released patches for CVE-2026-31431 in the following versions:

• 6.18.22
• 6.19.12
• 7.0

The patch addresses the root cause by removing the flawed in-place operation mechanism. It restores the safer, “out-of-place” handling method, ensuring that source and destination memory mappings are kept strictly separate, thereby preventing the buffer overflow.

Immediate Action Required: System administrators should prioritize updating their kernels to the patched versions listed above.

Emergency Mitigation: If an immediate patch is not feasible due to uptime requirements, you can mitigate the risk by disabling the vulnerable module. You can prevent the algif_aead module from loading by adding an install rule to your modprobe configuration:

# Create a configuration file to disable the module
echo "install algif_aead /bin/false" | sudo tee /etc/modprobe.d/copy-fail-mitigation.conf

# Remove the module from the current running session
sudo modprobe -r algif_aead

Note: Disabling this module may impact applications that rely on specific authenticated encryption (AEAD) functionalities.