CVE-2026-31431 "Copy Fail": 732-Byte Linux Root Exploit, Actively Exploited

Published 2026-10-08 · Last updated 2026-10-08

What the bug is

Linux exposes its internal crypto code to user programs through a socket type called AF_ALG. In 2017 an optimisation made the AEAD part of it (algif_aead) decrypt “in place”. Combined with splice(), which hands file pages directly to the socket, that lets the authencesn template write 4 bytes of attacker-chosen data into the page cache, the kernel’s in-memory copy of a file.

It works on any file the attacker can merely read. The researchers at Theori showed a 732-byte Python script that patches a setuid-root binary in memory and runs it. Any local account, including a hacked web app running as www-data, gets root within seconds.

Timeline: reported to the kernel team 2026-03-23, fixed in mainline 2026-04-01, disclosed 2026-04-29, and on CISA’s Known Exploited Vulnerabilities list two days later.

Containers and the page cache

The page cache is shared by every process on the machine, across container boundaries. A file shared between a container and the host (a common base image layer, a bind mount) can be modified from inside the container, and the host sees the modified copy. That is why Copy Fail is treated as a potential container escape and not just a local root bug.

The write also skips the normal write path, so the page is never marked dirty and never reaches disk. On-disk integrity checks like debsums or AIDE won’t see it, and a reboot or cache eviction erases the evidence.

Am I affected?

# Kernel you are running
uname -r

# Is the vulnerable module loaded / blocked?
lsmod | grep algif_aead
grep -r algif_aead /etc/modprobe.d/

# Proxmox: which kernel build first carried the fix?
apt changelog proxmox-kernel-6.8 2>/dev/null | grep -m1 -B6 'copy.fail'

Platform	Fixed in
Proxmox VE 8 (6.8)	proxmox-kernel-6.8.12-22 (2026-04-30)
Proxmox VE 9	Fixed kernels published 2026-04-30. Check apt changelog for your kernel series.
Debian 12 bookworm	6.1.170-1 (DSA-6243-1)
Debian 13 trixie	6.12.85-1 (DSA-6238-1)
Ubuntu / RHEL / SUSE / Amazon Linux	All confirmed exploitable before patching. Install the vendor kernel update for CVE-2026-31431.

How to patch

# Debian / Ubuntu / Proxmox
apt update && apt full-upgrade
reboot
uname -r     # confirm the new kernel is running

As with any kernel fix, the update does nothing until you reboot into it.

Workaround: block algif_aead

Unlike most kernel bugs, this one has a clean stopgap. Very little userspace software uses AF_ALG’s AEAD interface, so blocking the module is low-risk for most servers (test on one box first):

echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif-aead.conf
rmmod algif_aead 2>/dev/null
lsmod | grep algif_aead   # should print nothing

On a Proxmox host this protects every container, because containers can’t load kernel modules themselves. Keep the block in place until you’ve rebooted into a fixed kernel, then you can remove it.

Detecting exploitation

Since the tampering lives only in memory, look at behaviour instead of files:

• Unexpected root shells or processes whose parent is a service account (www-data, mc, nobody).
• AF_ALG socket use by processes that have no business doing crypto. With auditd: auditctl -a always,exit -F arch=b64 -S socket -F a0=38 -k af_alg (38 = AF_ALG).
• New SSH keys, users, cron jobs, or systemd units created around the time a web app or game server was compromised.

Sources

• CVE-2026-31431 record (CVE.org)
• CISA Known Exploited Vulnerabilities catalog (added 2026-05-01)
• Theori / Xint: Copy Fail write-up
• Debian security tracker

← Back to Knowledge Base