Cybersecurity researchers have now disclosed details of a Linux local privilege escalation (LPE) flaw that could allow an unprivileged local user to obtain root access.
Moreover, the high-severity vulnerability tracked as CVE-2026-31431 (CVSS score: 7.8) carries the codename Copy Fail, as identified by Xint.io and Theori.
“An unprivileged local user can write four controlled bytes into the page cache of any readable file on a Linux system, and use that to gain root,” the vulnerability research team at Xint.io and Theori said.
At its core, the vulnerability stems from a logic flaw in the Linux kernel’s cryptographic subsystem, specifically within the algif_aead module. Notably, developers introduced this issue through a source code commit in August 2017.
Exploitation Mechanism and Impact
Consequently, attackers can exploit this shortcoming using a simple 732-byte Python script to edit a setuid binary and obtain root privileges across nearly all Linux distributions shipped since 2017, including Amazon Linux, RHEL, SUSE, and Ubuntu.
Furthermore, the Python exploit involves four steps –
- First, open an AF_ALG socket and bind to authencesn(hmac(sha256),cbc(aes))
- Next, construct the shellcode payload
- Then, trigger the write operation to the kernel’s cached copy of “/usr/bin/su”
- Finally, call execve(“/usr/bin/su”) to load the injected shellcode and run it as root
Although the vulnerability does not support remote exploitation in isolation, a local unprivileged user can still gain root access simply by corrupting the page cache of a setuid binary. Additionally, this one introduces cross-container risks, since the page cache remains shared across all processes on a system.
In response to the disclosure, major Linux distributions have released their own advisories –
Interestingly, Copy Fail echoes Dirty Pipe (CVE-2022-0847), another Linux kernel LPE vulnerability that allowed unprivileged users to splice data into the page cache of read-only files and overwrite sensitive files to achieve code execution.
Expert Insights on the Vulnerability
“Copy Fail is the same class of primitive, in a different subsystem,” Bugcrowd’s David Brumley said. “The 2017 in-place optimization in algif_aead allows a page-cache page to end up in the kernel’s writable destination scatterlist for an AEAD operation submitted over an AF_ALG socket. An unprivileged process can then drive splice() into that socket and complete a small, targeted write into the page cache of a file it doesn’t own.”
What makes this vulnerability particularly dangerous is that attackers can reliably trigger it without requiring any race condition or kernel offset. On top of that, the same exploit works consistently across distributions.
“This vulnerability is unique because it has four properties that almost never appear together: it’s portable, tiny, stealthy, and cross-container,” a Xint.io spokesperson told The Hacker News in a statement. “It allows any user account, no matter how low-level, to increase their privilege to full admin access. It also allows them to bypass sandboxing and works across all Linux versions and distributions.”
Source: TheHackerNews
Read more at Impreza News
