CVE-2026-31431 Copy Fail Linux Kernel Flaw Enables Local Root Privilege Escalation

The issue is not a remote code execution vulnerability by itself. It becomes dangerous when an attacker already has local code execution, a shell account, a compromised container, access to a CI runner, or another foothold on a shared Linux host.

CISA added CVE-2026-31431 to its Known Exploited Vulnerabilities catalog on May 1, 2026. Microsoft described observed exploitation as limited and primarily seen in proof-of-concept testing, but warned that the availability of a working PoC increases the likelihood of broader threat actor use.

Summary

Copy Fail is a high-impact Linux kernel privilege escalation issue because it affects a common kernel interface, requires only low privileges, and does not require user interaction. The CVSS 3.1 score assigned by the kernel.org CNA is 7.8 High with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

The vulnerability matters most for environments where untrusted code can run on a shared kernel. That includes Kubernetes worker nodes, container platforms, build systems, self-hosted CI runners, shared development boxes, jump hosts, research sandboxes, cloud SaaS platforms running user code, and multi-user Linux servers.

Defenders should prioritize kernel updates and vendor-specific mitigations. Where immediate patching is not possible, vendors and advisories recommend disabling or blocking the affected algif_aead/AF_ALG exposure according to distribution guidance.

What happened

The Linux kernel CVE record describes the issue as a vulnerability resolved by reverting algif_aead to operating out-of-place. The kernel.org CNA notes that there is no benefit in operating in-place in algif_aead because the source and destination come from different mappings.

Theori/Xint publicly disclosed the flaw as Copy Fail on April 29, 2026, after reporting it to the Linux kernel security team in March 2026. Theori’s public write-up says the issue stems from an in-place optimization introduced in 2017 that allowed page-cache pages to be placed into a writable scatterlist under specific crypto API behavior.

CISA later added CVE-2026-31431 to the Known Exploited Vulnerabilities catalog with a remediation due date of May 15, 2026, for covered U.S. federal civilian agencies. That KEV entry means CISA has evidence of exploitation in the wild.

Affected products

Technical details

CVE-2026-31431 is a local privilege escalation vulnerability in the Linux kernel crypto subsystem. The affected area is algif_aead, part of the AF_ALG userspace crypto API.

According to the available technical sources, the flaw involves an unsafe in-place operation path where source and destination mappings differ. Under specific use of the kernel crypto interface and page-cache-backed data, the vulnerable logic can allow an unprivileged local process to corrupt the page cache of readable files.

Theori/Xint describes the core primitive as a controlled four-byte write into the page cache. Microsoft describes the impact as corruption of cached content for readable files, including privileged binaries, without modifying the on-disk file. This can lead to execution with root privileges when the affected cached content is later used.

Confirmed technical attributes:

This article intentionally does not include exploit code, payloads, or step-by-step exploitation details.

Exploitation status

CISA has listed CVE-2026-31431 in the Known Exploited Vulnerabilities catalog, which confirms evidence of exploitation in the wild.

Microsoft reported that active exploitation had been limited and primarily observed in proof-of-concept testing at the time of its May 1, 2026 analysis. Microsoft also warned that the availability of a fully working public PoC and the broad Linux exposure could increase exploitation attempts.

Theori/Xint published a public proof of concept for defensive validation. Public PoC availability should not be treated as the same thing as widespread exploitation, but it materially increases operational risk for exposed shared Linux environments.

Impact

Successful exploitation can allow an unprivileged local user to gain root privileges on a vulnerable Linux host. That is serious on any system, but the risk is highest where local execution is expected or easily obtained.

Practical impact includes:

Microsoft notes that the issue is not remotely exploitable in isolation. Attackers need local code execution or a similar foothold first.

Defender guidance

Prioritize this vulnerability based on where untrusted users or workloads can run code.

Recommended defender actions:

1. Patch Linux kernel packages using your distribution’s official security updates.
2. Prioritize Kubernetes nodes, container hosts, CI runners, shared servers, developer jump boxes, and any system running untrusted code.
3. Apply vendor-documented mitigations if kernel updates are not yet available or cannot be deployed immediately.
4. Restrict or block access to affected kernel crypto interfaces for untrusted workloads where supported by your container/runtime policy.
5. Review container admission policies and avoid privileged containers for untrusted workloads.
6. Recycle or rebuild nodes where exploitation is suspected, especially in containerized and CI environments.
7. Treat successful exploitation as root-level host compromise, not merely container compromise.
8. Verify kernel package versions after patching and reboot systems where required by the vendor.

Do not rely only on file integrity monitoring for this issue. The attack affects page-cache-backed content in memory, so disk-based checks alone may not show the modification.

Detection and hunting notes

No universal public IOC set is available from the authoritative sources reviewed. Detection should focus on behavior, vulnerable asset exposure, and unusual privilege transitions.

Useful hunting ideas:

For container environments, also review runtime events where untrusted workloads create unusual socket families, execute setuid binaries, or trigger unexpected host-level behavior.

Mitigation

The primary mitigation is to install the fixed kernel packages from your Linux distribution.

Where immediate patching is not possible, use vendor-supported workarounds. Multiple sources recommend disabling or blocking the affected algif_aead exposure, and Theori/Xint also recommends blocking AF_ALG socket creation for untrusted workloads through runtime policy such as seccomp.

Mitigation guidance differs by distribution and architecture. Follow the vendor page for your operating system rather than copying commands from third-party posts.

Timeline

Bottom line

CVE-2026-31431 is not a network worm and it does not give remote attackers access by itself. That should not make defenders comfortable.

Copy Fail is dangerous because any local foothold on a vulnerable shared Linux kernel may become root. Patch Linux kernels quickly, prioritize shared and containerized environments, apply vendor mitigations where patching is delayed, and treat suspected exploitation as a full host compromise.