Linux kernel privilege escalation via setuid binary cache writes
Linux kernel vulnerability CVE-2026-31431 (Copy Fail) allows unprivileged local users to escalate privileges to root via controlled 4-byte writes to setuid binaries' page cache.
Sourcekb.cert.org — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-31431 as exploited in the wild.
A privilege escalation vulnerability has been discovered in the Linux kernel's algif_aead module, affecting versions 4.17 and later since 2017. The flaw allows an unprivileged local user to write 4 controlled bytes into the page cache of any readable file without race conditions. Critically, the corrupted page is not marked dirty, preventing modified contents from being written to disk and bypassing integrity verification mechanisms. An attacker can exploit this to modify setuid binaries in memory and escalate to root privileges. The vulnerability was discovered by Taeyang Lee of Theori using AI-based static analysis tools during examination of the kernel cryptographic subsystem. A 732-byte proof-of-concept Python script demonstrates reliable exploitation across many distributions released since 2017.
Public PoC exploit code is available, significantly increasing exploitation risk. Organizations should immediately apply vendor patches that revert AF_ALG AEAD to out-of-place operations. For systems where immediate patching is not possible, the algif_aead module can be disabled via modprobe blacklisting or initcall_blacklist kernel parameters. Container environments face additional risk of container escape and should implement seccomp filtering, AppArmor policies, or eBPF controls to restrict AF_ALG socket creation. Virtualization provides hardware-enforced isolation that prevents VM escape, limiting impact to individual VM instances.
Mentioned in this report
Detection guidance
Linux algif_aead Kernel Module Explicitly Loaded
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects explicit loading of the algif_aead kernel module via modprobe/insmod, which is required for exploitation of CVE-2026-31431 and is often disabled/blacklisted as a mitigation; unexpected loading may indicate exploitation staging. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Linux algif_aead Kernel Module Explicitly Loaded
id: 63616e6b-bf67-591b-86fe-d32bd9ae5d3d
status: experimental
description: Detects explicit loading of the algif_aead kernel module, which is abused
by CVE-2026-31431 to write attacker-controlled bytes into the page cache without
marking pages dirty, enabling privilege escalation via setuid binary tampering.
This module is commonly blacklisted as a mitigation, so unexpected reloading is
notable.
references:
- CVE-2026-31431
logsource:
category: process_creation
product: linux
detection:
selection:
Image|endswith:
- /modprobe
- /insmod
CommandLine|contains: algif_aead
filter_expected:
ParentImage|endswith:
- /systemd
- /init
condition: selection and not filter_expected
falsepositives:
- Legitimate cryptographic workloads that intentionally use the AF_ALG AEAD interface
(e.g. dm-crypt or custom crypto acceleration setups) explicitly loading the module
- Administrator re-enabling the module after patching for a use case that requires
AEAD offload
level: medium
tags:
- attack.t1068
- attack.privilege-escalation
author: Vorant
Unprivileged Process Creating AF_ALG AEAD Socket via Python
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects short-lived Python (or similar scripting) process execution patterns consistent with the public PoC for CVE-2026-31431, which opens an AF_ALG AEAD socket to corrupt page cache contents of a target file such as a setuid binary; flags interpreter invocations referencing AF_ALG/algif_aead constructs. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unprivileged Process Creating AF_ALG AEAD Socket via Python
id: 79e8e467-fa40-5e9e-9db0-21f12cb91f53
status: experimental
description: Detects execution of scripting interpreters (commonly Python, matching
the public 732-byte PoC) with command-line or script references to AF_ALG/algif_aead/SOL_ALG
socket primitives, consistent with exploitation of CVE-2026-31431 to overwrite page
cache contents of a readable file (e.g. a setuid binary) without marking it dirty.
references:
- CVE-2026-31431
logsource:
category: process_creation
product: linux
detection:
selection:
Image|endswith:
- /python
- /python3
CommandLine|contains:
- AF_ALG
- algif_aead
- SOL_ALG
- ALG_SET_AEAD
condition: selection
falsepositives:
- Legitimate cryptographic testing or benchmarking scripts that intentionally exercise
the Linux AF_ALG kernel crypto API
- Security research or CI test suites validating kernel crypto subsystem functionality
level: high
tags:
- attack.t1068
- attack.privilege-escalation
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://kb.cert.org/vuls/id/260001
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs