Linux kernel vulnerability CVE-2026-31431 (Copy Fail) allows unprivileged local users to…
Linux kernel vulnerability CVE-2026-31431 (Copy Fail) allows unprivileged local users to escalate privileges to root via controlled 4-byte writes to setuid binaries' page cache.
A privilege escalation vulnerability has been discovered in the Linux kernel's algif_aead module, affecting versions 4.17 and later since 2017. The flaw allows an unprivileged local user to write 4 controlled bytes into the page cache of any readable file without race conditions. Critically, the corrupted page is not marked dirty, preventing modified contents from being written to disk and bypassing integrity verification mechanisms. An attacker can exploit this to modify setuid binaries in memory and escalate to root privileges. The vulnerability was discovered by Taeyang Lee of Theori using AI-based static analysis tools during examination of the kernel cryptographic subsystem. A 732-byte proof-of-concept Python script demonstrates reliable exploitation across many distributions released since 2017.
Public PoC exploit code is available, significantly increasing exploitation risk. Organizations should immediately apply vendor patches that revert AF_ALG AEAD to out-of-place operations. For systems where immediate patching is not possible, the algif_aead module can be disabled via modprobe blacklisting or initcall_blacklist kernel parameters. Container environments face additional risk of container escape and should implement seccomp filtering, AppArmor policies, or eBPF controls to restrict AF_ALG socket creation. Virtualization provides hardware-enforced isolation that prevents VM escape, limiting impact to individual VM instances.
Mentioned in this report
Detection guidance
Linux algif_aead Kernel Module Explicitly Loaded
Detects explicit loading of the algif_aead kernel module via modprobe/insmod, which is required for exploitation of CVE-2026-31431 and is often disabled/blacklisted as a mitigation; unexpected loading may indicate exploitation staging. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Linux algif_aead Kernel Module Explicitly Loaded
id: 63616e6b-bf67-591b-86fe-d32bd9ae5d3d
status: experimental
description: Detects explicit loading of the algif_aead kernel module, which is abused
by CVE-2026-31431 to write attacker-controlled bytes into the page cache without
marking pages dirty, enabling privilege escalation via setuid binary tampering.
This module is commonly blacklisted as a mitigation, so unexpected reloading is
notable.
references:
- CVE-2026-31431
logsource:
category: process_creation
product: linux
detection:
selection:
Image|endswith:
- /modprobe
- /insmod
CommandLine|contains: algif_aead
filter_expected:
ParentImage|endswith:
- /systemd
- /init
condition: selection and not filter_expected
falsepositives:
- Legitimate cryptographic workloads that intentionally use the AF_ALG AEAD interface
(e.g. dm-crypt or custom crypto acceleration setups) explicitly loading the module
- Administrator re-enabling the module after patching for a use case that requires
AEAD offload
level: medium
tags:
- attack.t1068
- attack.privilege_escalation
author: Vorant
Unprivileged Process Creating AF_ALG AEAD Socket via Python
Detects short-lived Python (or similar scripting) process execution patterns consistent with the public PoC for CVE-2026-31431, which opens an AF_ALG AEAD socket to corrupt page cache contents of a target file such as a setuid binary; flags interpreter invocations referencing AF_ALG/algif_aead constructs. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unprivileged Process Creating AF_ALG AEAD Socket via Python
id: 79e8e467-fa40-5e9e-9db0-21f12cb91f53
status: experimental
description: Detects execution of scripting interpreters (commonly Python, matching
the public 732-byte PoC) with command-line or script references to AF_ALG/algif_aead/SOL_ALG
socket primitives, consistent with exploitation of CVE-2026-31431 to overwrite page
cache contents of a readable file (e.g. a setuid binary) without marking it dirty.
references:
- CVE-2026-31431
logsource:
category: process_creation
product: linux
detection:
selection:
Image|endswith:
- /python
- /python3
CommandLine|contains:
- AF_ALG
- algif_aead
- SOL_ALG
- ALG_SET_AEAD
condition: selection
falsepositives:
- Legitimate cryptographic testing or benchmarking scripts that intentionally exercise
the Linux AF_ALG kernel crypto API
- Security research or CI test suites validating kernel crypto subsystem functionality
level: high
tags:
- attack.t1068
- attack.privilege_escalation
author: Vorant
1 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://kb.cert.org/vuls/id/260001
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free