In 2017, a small optimization commit was merged.
A change in the algif_aead module that started processing AEAD operations in-place.
Nobody noticed at the time. Last month, the Wiz team took the bug chain this change introduced and, with a 732-byte Python script, got root on every major Linux distribution.
It’s called Copy Fail. CVE-2026-31431. CVSS 7.8.
It’s a local privilege escalation, but it’s worth remembering how wide an attack surface “local” is in cloud, container and CI/CD environments. In a multi-tenant environment it’s quite dangerous.
Here’s the mechanism: AF_ALG is the kernel’s userspace crypto API. The attacker opens a socket there and binds it to the “authencesn(hmac(sha256),cbc(aes))” template.
Then, with “splice()”, they feed this socket the page cache pages of any file on the system they have read access to.
Because the AEAD operation runs in-place, the kernel takes the page into the destination scatterlist.
A specific 4-byte slot of the “AAD” data sent with “sendmsg()” gets written deterministically into the target file’s page cache.
In other words, a 4-byte write primitive into the in-memory copy of a file that doesn’t belong to the user.
It looks small.
The default exploit targets “/usr/bin/su”.
A setuid root binary that ships out of the box on most distributions. The shellcode payload is written into the page in 4-byte chunks.
Interesting detail: the kernel doesn’t mark this page as dirty for writeback.
The file on disk doesn’t change. AIDE, integrity check tools, on-disk hash comparison…
None of them see it.
But the page cache returns it to whoever reads it anyway, so the corrupted in-memory version is the one that’s live on the system.
Affected kernel versions: mainline from 4.14 up to 7.0-rc. 6.18.x before 6.18.22 and 6.19.x before 6.19.12.
To check your version, the classic:
uname -rIf you want to see which setuid binaries you have on the system:
find / -perm -4000 -type f 2>/dev/nullOn the mitigation side, removing AF_ALG from containers and unprivileged users is the first step.
You can block the “socket(AF_ALG, …)” call with seccomp profiles.
Ubuntu, RHEL, SUSE and Amazon Linux have released patches.
If you can update the kernel, that’s the priority.
A note on container breakout: since the page cache is shared with the host, this primitive also crosses container boundaries.
So an attacker inside a container can affect a setuid binary on the host.
In Kubernetes environments, this is a separate conversation these days.
Something of this scale staying under the radar for 8 years shouldn’t surprise us too much.
Making the crypto API usable from user space was always a controversial design decision anyway.
Sources:
https://www.wiz.io/blog/copyfail-cve-2026-31431-linux-privilege-escalation-vulnerability
https://nvd.nist.gov/vuln/detail/CVE-2026-31431