Full Report
Detect and mitigate Copy.Fail (CVE-2026-31431), an easily exploitable vulnerability in the Linux kernel that allows escalation from an unprivileged local user account to root access.
Analysis Summary
# Vulnerability: Copy.Fail - Linux Kernel Local Privilege Escalation
## CVE Details
- **CVE ID**: CVE-2026-31431
- **CVSS Score**: Not explicitly listed, but characterized as "easily exploitable" and "critical" (estimated High/Critical range)
- **CWE**: CWE-120 (Buffer Overflow) / CWE-787 (Out-of-bounds Write) - Logic flaw in scatter-gather list handling.
## Affected Systems
- **Products**: Linux Kernel
- **Versions**: Nearly all versions released between 2017 and May 1, 2026 (prior to the fix).
- **Configurations**: Systems with `AF_ALG` sockets enabled and systems using the `algif_aead` crypto implementation.
## Vulnerability Description
CVE-2026-31431 (Copy.Fail) is a logic flaw within the Linux kernel's AEAD crypto implementation (`algif_aead`). The vulnerability arises from improper handling of scatter-gather lists, allowing an out-of-bounds write.
By chaining `AF_ALG` sockets with the `splice()` system call, an unprivileged local user can write 4 controlled bytes into the page cache of any readable file. Because the page cache stores the in-memory version of executables, an attacker can modify sensitive binaries (such as `/usr/bin/su` or `sudo`) in memory without altering the files on disk. This allows for code injection into privileged processes to gain root access or escape containers by modifying shared base image layers.
## Exploitation
- **Status**: PoC available (Public Kubernetes/Container escape and Local Privilege Escalation exploits exist).
- **Complexity**: Low
- **Attack Vector**: Local
## Impact
- **Confidentiality**: High (Full access to system data via root escalation)
- **Integrity**: High (Ability to modify in-memory binaries and system state)
- **Availability**: High (Ability to disrupt system services or crash the kernel)
## Remediation
### Patches
- **Upstream Linux Kernel**: Fixed (Mainline commit `a664bf3d603d`).
- **Debian**: Patched in `sid` (unstable) and `forky`.
- **Arch Linux**: Likely patched via rolling release.
- **Other Distros**: Ubuntu, RHEL, Fedora, Amazon Linux, and SUSE were in varying stages of "Not Patched" or "Patching in progress" as of May 1, 2026. Users should update to the latest available kernel immediately.
### Workarounds
1. **Disable the vulnerable module**:
bash
echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
rmmod algif_aead
2. **Restrict Sockets**: Use `seccomp` policies to block the creation of `AF_ALG` sockets.
## Detection
- **Indicators of Compromise (IoC)**:
- Suspicious loading of the PF_ALG protocol: `NET: Registered PF_ALG protocol family` in `kern.log` or `syslog` outside of boot time.
- Network activity reaching out to known exploit hosts: `hxxps[://]copy[.]fail/exp`.
- **Detection Methods**: Monitor for unprivileged users calling `splice()` in conjunction with `AF_ALG` sockets, or unauthorized memory modifications to page caches of `setuid` binaries.
## References
- **Vendor Advisory**: hxxps[://]www[.]wiz[.]io/blog/copyfail-cve-2026-31431-linux-privilege-escalation-vulnerability
- **Public PoC**: hxxps[://]github[.]com/Percivalll/Copy-Fail-CVE-2026-31431-Kubernetes-PoC
- **Kernel Commit**: hxxps[://]git[.]kernel[.]org/pub/scm/linux/kernel/git/torvalds/linux[.]git/commit/?id=a664bf3d603d (Simulated link based on commit ID)