VU#260001: Linux kernel contains local privilege escalation vulnerability (Copy Fail)
Best suited for
- Seniority
- Director
- Job function
- Cybersecurity / Information Security
- Persona
- Security Operations Practitioner
- Buyer role
- Decision Maker / Budget Holder
- Decision stage
- Which to buy
- Adoption curve
- Early Majority
- Technology maturity
- Established Technology
Our classification, not the publisher's statement. Best suited for, not only for.
Linux kernel versions 4.17 and later contain a local privilege escalation vulnerability that can let an unprivileged local user gain root access. The issue has been publicly disclosed with the identifier CVE-2026-31431 and is commonly referred to as “Copy Fail,” with the main outcome being escalation from local access to root.
The Linux kernel includes the algif_aead module since version 4.17, which provides user space access to authenticated encryption with associated data (AEAD) operations via the AF_ALG interface. The module may be present as a loadable kernel module or compiled directly into the kernel, depending on the Linux distribution or a custom built Linux install. Per the disclosure statement at https://copy.fail, an unprivileged local user can write 4 controlled bytes into the page cache of any readable file on a Linux system to gain root. The vulnerability is caused by a logic flaw in the Linux kernel’s algif_aead (AF_ALG) implementation, enabling a reliable controlled 4-byte write into the page cache of any readable file without race conditions or timing dependencies. The corrupted page is not marked dirty, so modified contents are never written back to disk; the underlying file remains unchanged, allowing in-memory corruption to bypass checksum and file integrity verification mechanisms. Because subsequent reads are served from the page cache, an attacker can target a setuid binary and modify its in-memory contents to achieve local privilege escalation to root. A 732-byte proof-of-concept Python script demonstrates exploitation by modifying a setuid binary to obtain root privileges on many Linux distributions released since 2017. The vulnerability was discovered by Taeyang Lee of Theori, with assistance from the AI-based static application security testing (SAST) tool Xint Code during analysis of the Linux kernel cryptographic subsystem.
The vulnerability allows an unprivileged local user to modify the in-memory contents of a setuid binary and escalate privileges to root. Public proof-of-concept (PoC) exploit code is available, which increases the likelihood of exploitation.
The remediation guidance states to apply the upstream kernel patch that addresses the issue by reverting AF_ALG AEAD to an out-of-place operation. It also advises updating the distribution’s kernel package as soon as vendor patches become available, noting that most major Linux distributions are expected to release fixes through standard update channels. The documented workarounds include disabling the algif_aead module when it is loadable by writing “install algif_aead /bin/false” to /etc/modprobe.d/disable-algif-aead.conf and removing it with rmmod algif_aead 2>/dev/null. If algif_aead is compiled into the kernel, the guidance says a parameter can be added to grub or systemd-boot or grubby depending on the boot configuration: initcall_blacklist=algif_aead_init, with a system reboot required for the change to take effect. It adds that these workarounds may impact applications that rely on AF_ALG cryptographic interfaces. For containerized environments, it recommends considering one or more mitigations: seccomp filtering to restrict or deny system calls that create sockets using the AF_ALG address family (protocol 38), AppArmor policies to block creation of AF_ALG sockets via the network alg rule, and BPF-based enforcement to deny socket creation with address family AF_ALG (38). The mitigation section notes this guidance is adopted from bytedance for the vArmor community. The document also states that while the internal kernel within a VM or MicroVM is susceptible, standard virtualization provides hardware-enforced memory isolation, and the bug cannot be directly leveraged to facilitate a virtualization escape from a guest to the host; virtualization and micro-virtualization technologies are described as containing the impact to the individual VM instance.
Vendor guidance provided in the advisory content states that the vulnerability was disclosed by Theori.io, and the document was written by Bob Kemerer and Vijay Sarvepalli.
Blog post, originally published at kb.cert.org.