CopyFail Linux Kernel Flaw Enables Root via Page-Cache Corruption

Researchers disclosed CVE-2026-31431, dubbed CopyFail, a Linux local privilege escalation flaw in the kernel crypto subsystem's algif_aead/AF_ALG AEAD path that lets a low-privileged local user corrupt the page cache of readable files and gain root. The bug traces to a 2017 in-place AEAD optimization introduced in Linux 4.14 by commit 72548b093ee3, which allowed splice-backed file pages to be reused as writable crypto buffers; attackers can then achieve a controlled write into the cached copy of targets such as setuid binaries while leaving the on-disk file unchanged. Researchers published a compact Python proof of concept said to work reliably across major distributions including Ubuntu, RHEL, SUSE, Amazon Linux, Debian, Fedora, and Arch, and warned the shared page cache also makes the flaw relevant for container escapes, CI runners, and multi-tenant cloud hosts.

Upstream fixed the issue by reverting algif_aead to out-of-place operation in Linux 7.0, 6.19.12, and 6.18.22, while older long-term branches initially lagged because the patch did not apply cleanly and required backports or workaround patches. Major vendors and downstream projects began shipping advisories and kernel updates, and temporary mitigations included disabling or blacklisting algif_aead, blocking AF_ALG socket creation with seccomp or eBPF, or using the kernel boot parameter initcall_blacklist=algif_aead_init where the feature was built in. After public exploit code spread and additional exploit ports appeared, CISA added the flaw to its Known Exploited Vulnerabilities catalog, and defenders published detections focused on suspicious AF_ALG, splice(), and setuid execution activity because traditional file-integrity checks may miss the in-memory-only tampering.