Researchers from Xint have identified a vulnerability (CVE-2026-31431) in the Linux kernel that allows an unprivileged user to gain root access to the system. The issue has been given the code name Copy Fail. A prototype exploit is available. The vulnerability has been demonstrated in Ubuntu 24.04 LTS, Amazon Linux 2023, RHEL 10.1, and SUSE 16, but it is noted that kernel packages from other distributions, including Debian, Arch, Fedora, Rocky, and Alma, are also affected, though they were not specifically tested.<\/p>\n
The vulnerability is caused by a logical error in the Linux kernel's crypto API (AF_ALG), introduced during optimization in 2017 that removed unnecessary buffering by performing in-place operations on AEAD (Authenticated Encryption with Associated Data) block ciphering. The issue arose from careless use of the splice() function, which transfers data between file descriptors and pipes without copying, by passing references to elements in the page cache. After the optimization, when a file is sent to the AF_ALG socket for decryption, a direct reference to elements in the kernel's page cache containing the file's data was recorded in the scatterlist structure instead of a reference to a separate buffer.<\/p>\n
In the decryption process, AEAD mixed the linked data of the authentication tag with the additional authenticatable data (AAD, Associated Authenticated Data) and ciphertext copied into the RX buffer. The offset for the write operation in the authentication tag was calculated relative to the copied data without proper checks, allowing arbitrary areas in the page cache to be overwritten.<\/p>\n
The vulnerability allows an attacker to overwrite 4 bytes at a chosen offset with each request, enabling them to alter the contents of any readable file in the system through a series of requests, after ensuring it is cached. Since during any read operations the contents are served primarily from the page cache, after replacing the information in the page cache, the kernel or process reading data from the file will receive not the actual data, but the substituted data, which can be exploited for code injection into executable files or loaded shared libraries.<\/p>\n
To execute code with root privileges, it is sufficient to cause a change in the page cache for any executable file with the suid root flag.
\nThe proposed exploit reads the executable file \/usr\/bin\/su and modifies the content of this file loaded into the page cache to inject its own code. When the 'su' utility is subsequently executed, a modified copy from the page cache will be loaded into memory instead of the original executable file from the storage.<\/p>\n
The exploit is universal, does not require adaptation to distributions or kernel versions, and can be used with any distribution. Since container isolation uses a shared page cache for all containers, the vulnerability can be exploited to gain access to the host environment from the container (an exploit for bypassing isolation in Kubernetes is promised to be published later).<\/p>\n
The vulnerability was identified using AI approximately after an hour of experiments analyzing the kernel's cryptographic subsystem code. The issue appears starting from Linux kernel 4.14, released in 2017, and has been fixed in kernels 6.18.22, 6.19.12, and 7.0. The status of vulnerabilities being fixed in distributions can be evaluated on these pages: Debian, Ubuntu, SUSE\/openSUSE, RHEL, Gentoo, Arch,
\nFedora, ROSA.<\/p>\n
As a workaround to the protection, you can disable the kernel module algif_aead, which is used in OpenSSL when the afalg engine is explicitly enabled, and in certain applications (to check for running applications of this type, you can use the command 'lsof | grep AF_ALG'):<\/p>\n