Copy Fail Linux Kernel Local Privilege Escalation (CVE-2026-31431)

Metadata

Affected Target

Summary

Copy Fail (CVE-2026-31431) is a Linux kernel local privilege-escalation vulnerability published by Theori (Xint Code). The provided PoC abuses AF_ALG AEAD socket operations with crafted parameters and splice() writes to patch privileged executable bytes and obtain root execution. Public exploit code is available and demonstrates practical exploitation against multiple major Linux distributions.

Vulnerability Details

Root Cause

The exploit indicates an unsafe kernel handling path in AEAD/authenc processing exposed through AF_ALG sockets. Crafted socket options and message metadata allow attacker-controlled writes during crypto processing, enabling corruption of privileged executable data from an unprivileged context.

Attack Vector

An attacker with local shell access runs the Python PoC. The script opens /usr/bin/su, creates an AF_ALG socket configured for authenc(hmac(sha256),cbc(aes)), repeatedly issues crafted sendmsg + splice operations, and then executes su to obtain elevated privileges.

Impact

Successful exploitation yields local privilege escalation to root on affected kernels. This allows full host compromise, including arbitrary command execution, persistence, and security control bypass.

Environment / Lab Setup

OS:           Ubuntu 24.04 LTS / Amazon Linux 2023 / RHEL 10.1 / SUSE 16
Target:       Linux kernel versions listed in Tested Distro / Version
Attacker:     Local unprivileged user on target host
Tools:        python3

Setup Steps

1
2
3

git clone https://github.com/theori-io/copy-fail-CVE-2026-31431
cd copy-fail-CVE-2026-31431
python3 copy_fail_exp.py

Proof of Concept

Step-by-Step Reproduction

1. Prepare local lab host — Use a test kernel/distribution listed by upstream research.

   1

   uname -a

2. Run exploit code as local user

   1	python3 copy_fail_exp.py

3. Confirm privilege escalation

   1 2

   id whoami

Exploit Code

See copy_fail_exp.py in this folder.

1
2

#!/usr/bin/env python3
import os as g,zlib,socket as s

Expected Output

uid=0(root) gid=0(root) groups=0(root)
root

Screenshots / Evidence

• No screenshots bundled in upstream repo.

Detection & Indicators of Compromise

SIEM / IDS Rule (example):

alert audit any any -> any any (msg:"Possible Copy Fail local exploit behavior"; content:"AF_ALG"; content:"splice"; sid:900031431;)

Remediation

References

• CVE-2026-31431
• Theori Repository - copy-fail-CVE-2026-31431
• Technical Writeup - xint.io

Notes

Auto-ingested from https://github.com/theori-io/copy-fail-CVE-2026-31431 on 2026-05-17.