CVE-2026-31431

HIGH(7.8)KEVLikely Exploited

Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability

Description

CVE-2026-31431 is a HIGH severity local privilege escalation vulnerability in the Linux kernel's algif_aead AF_ALG socket interface, with a CVSS 3.1 score of 7.8. The flaw — publicly known as "copy_fail" — stems from a kernel commit that introduced in-place operation in algif_aead, allowing a local user with access to the AEAD socket interface to manipulate the page cache and corrupt memory in a way that yields root privileges. The fix reverts the original commit and forces out-of-place operation, copying associated data instead of mapping it in place. CISA added CVE-2026-31431 to the KEV catalog on May 1, 2026, with an aggressive remediation deadline of May 15, 2026. Public exploit code is available from theori-io ("copy_fail"), and detailed write-ups have been published on websec.net and copy.fail. The EPSS score of 0.040 (88th percentile) reflects high relative likelihood of continued exploitation.

KEV Information

Vendor
Linux
Product
Kernel
Date Added
May 1, 2026
Due Date
May 15, 2026
Required Action
"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVSS Score

Vector String
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in Calculator
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
1.8
Impact Score
5.9

CWEs

CWE-669
CWE-1288

Affected Products

VendorProductVersion
linuxlinux kernel>= 4.14, < 5.10.254; >= 5.11, < 5.15.204; >= 5.16, < 6.1.170; >= 6.2, < 6.6.137; >= 6.7, < 6.12.85; >= 6.13, < 6.18.22; >= 6.19, < 6.19.12; 7.0
redhatopenshift container platform>= 4.12, < 4.12.89; >= 4.13, < 4.13.66; >= 4.14, < 4.14.65; >= 4.15, < 4.15.64; >= 4.16, < 4.16.61; >= 4.17, < 4.17.53; >= 4.18, < 4.18.40; >= 4.19, < 4.19.30; >= 4.20, < 4.20.21; >= 4.21, < 4.21.14; 4.0
redhatenterprise linux8.0; 9.0; 10.0
redhatenterprise linux aus8.4; 8.6
redhatenterprise linux eus8.4; 9.4; 9.6; 10.0
redhatenterprise linux tus8.6; 8.8
redhatenterprise linux update services for sap solutions8.6; 8.8; 9.0; 9.2
amazonamazon linux-
canonicalubuntu linux-; 14.04; 16.04; 18.04; 20.04; 22.04; 24.04; 25.10
debiandebian linux11.0; 12.0; 13.0
opensuseleap15.3; 15.4; 15.5; 15.6
susecaas platform4.0
suseenterprise storage6.0; 7.0; 7.1
susemanager proxy4.0; 4.1; 4.2; 4.3
susemanager retail branch server4.0; 4.1; 4.2; 4.3
susemanager server4.0; 4.1; 4.2; 4.3
suseopenstack cloud9.0
suseopenstack cloud crowbar9.0
susebasesystem module15
susedevelopment tools module15

Multiple CVSS Assessments

Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67(Secondary)
7.8
HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c(Secondary)
7.8
HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Weakness Type

CWE-669: Incorrect Resource Transfer Between Spheres

Incorrect Resource Transfer Between Spheres occurs when a product transfers a resource to another sphere in a way that violates the intended security boundaries — for example, transferring sensitive data to untrusted contexts or importing untrusted data into a privileged sphere. In CVE-2026-31431, the Linux kernel's algif_aead socket implementation transferred user-supplied page mappings into the kernel's cryptographic processing path in a way that conflated the user's source pages with the kernel's destination pages (in-place operation). Because the source and destination came from different mappings, the in-place optimization broke the security boundary between userspace and kernel-managed page cache memory, and a local attacker could leverage the mishandling to write attacker-controlled data into pages that the kernel later treats as trusted — escalating from a low-privileged local user to root.

Learn more: CWE-669 — Incorrect Resource Transfer Between Spheres

Impact Analysis

CVE-2026-31431 carries a CVSS 3.1 score of 7.8 (HIGH) with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — local attack vector with low complexity, only low privileges required (any user account that can call socket(AF_ALG)), no user interaction needed, and uniformly High impact across Confidentiality, Integrity, and Availability. The local attack vector is sometimes underestimated, but for multi-tenant Linux systems the impact is severe: containers, shared web hosts, CI runners, and developer machines that grant remote shell access to untrusted code all expose the AF_ALG interface to the attacker. Successful exploitation yields kernel-level code execution and full root privileges on the host, which on a containerized system means container escape, and on a hypervisor-host means tenant compromise. Because the bug is in the Linux kernel itself, the vulnerable code is shipped in essentially every major distribution running affected kernel versions, and the long range of affected versions (4.14 through 6.19.11) means that even slow-moving enterprise distributions are likely vulnerable until they pull the backported fix.

Exploit Maturity

Public Exploits: Multiple public proofs-of-concept and weaponized exploits exist for CVE-2026-31431. The theori-io research team has published a working exploit at github.com/theori-io/copy-fail-CVE-2026-31431; an in-depth technical write-up titled "copy_fail: Linux algif_aead page cache write to root" is available on websec.net; and a dedicated landing page at copy.fail documents the discovery. The OSS-Security mailing list has published more than 30 follow-up posts including additional exploit details and discussion. Active Exploitation: CISA confirmed in-the-wild exploitation by adding CVE-2026-31431 to the KEV catalog on May 1, 2026, with a remediation deadline of May 15, 2026. Exploitation Probability: With an EPSS score of 0.040 (88th percentile), the model rates the probability of continued exploitation as elevated — typical for kernel privilege-escalation bugs whose primary use is post-compromise escalation rather than mass internet scanning. Practical Risk: Operators of multi-tenant Linux environments — public clouds, container platforms, shared web hosts, CI/CD systems — should treat this vulnerability as a top-priority remediation, since a single low-privileged tenant can pivot to full host root.

Remediation

  1. Apply the upstream Linux kernel patch. Update to a kernel that includes the revert of the in-place algif_aead operation: 5.10.254, 5.15.204, 6.1.170, 6.6.137, 6.12.85, 6.18.22, 6.19.12, or 7.0+. The official patches are tracked at kernel.org and Red Hat's customer guidance is at access.redhat.com.
  2. Apply your distribution's security update. Pull the patched kernel package from your distro security feed (Debian/Ubuntu, RHEL/CentOS Stream, SUSE, Amazon Linux, etc.) and reboot. For long-running multi-tenant hosts, consider live-patching where supported (kpatch, kgraft, ksplice, livepatch).
  3. Interim mitigation: disable AF_ALG access. Where the patch cannot be applied immediately, restrict access to the AF_ALG socket interface. On systems that do not require userspace AEAD via algif, disable the algif_aead and af_alg modules (rmmod algif_aead af_alg) and prevent reload via modprobe.d. In containerized environments, drop the relevant kernel capabilities and apply seccomp profiles that block socket(AF_ALG, ...).
  4. Hunt for prior exploitation. Review kernel and audit logs for unexpected privilege-escalation events around the disclosure window (April 22–May 4, 2026). Check /var/log/audit/audit.log for setuid transitions to root from non-privileged users, look for unexpected dmesg entries from the algif_aead subsystem, and review container-runtime logs for capability-set changes.
  5. Long-term hardening. Apply the CWE-669 principle by minimizing kernel attack surface exposed to untrusted local code: use seccomp/Landlock to restrict syscalls, deploy unprivileged user namespaces, and consider kernel hardening features (kernel module loading lockdown, SECCOMP_FILTER, AppArmor or SELinux profiles) to reduce the practical exploitability of similar future bugs.

Technical Details

CVE-2026-31431 is a CWE-669 incorrect-resource-transfer flaw in the Linux kernel's algif_aead module, the userspace interface to the kernel's authenticated-encryption (AEAD) crypto API exposed via AF_ALG sockets. The vulnerability was introduced by commit 72548b093ee3, which converted algif_aead to operate in place on the user-supplied source pages instead of copying the data out-of-place to a kernel-allocated destination. Because the AF_ALG source and destination buffers come from different mappings, the in-place optimization causes the kernel to treat user-mapped page cache memory as the target of crypto output, allowing a carefully crafted sequence of socket operations to write attacker-controlled bytes into pages that other parts of the kernel (or other processes) treat as trusted. The published "copy_fail" exploit chains this primitive into a page-cache-to-root escalation: by selecting target pages backing a setuid-root binary or a privileged kernel data structure, the attacker overwrites them with malicious content and triggers execution as root. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects the local nature of the attack and its uniformly High impact. The fix reverts most of the in-place commit while retaining the copy of associated data — eliminating the conflation of user and kernel page mappings.

Frequently Asked Questions

Is CVE-2026-31431 being actively exploited?

Yes. CISA added CVE-2026-31431 to the KEV catalog on May 1, 2026, with a 14-day remediation deadline of May 15, 2026. Public exploit code is available from theori-io and websec.net, and the OSS-Security mailing list has documented active discussion since April 29, 2026. The EPSS score of 0.040 (88th percentile) reflects elevated continued exploitation likelihood.

What products are affected by CVE-2026-31431?

The upstream Linux kernel from version 4.14 through 6.19.11 (and version 7.0 prior to the fix) is vulnerable. Patched kernels: 5.10.254, 5.15.204, 6.1.170, 6.6.137, 6.12.85, 6.18.22, 6.19.12, and 7.0+. Every major Linux distribution shipping a kernel in this range is affected until it pulls the backport.

How do I fix CVE-2026-31431?

Update to a patched upstream kernel or your distribution's security release and reboot (or apply a live-patch where supported). Where patching is delayed, restrict access to the AF_ALG socket interface — disable algif_aead/af_alg kernel modules or use seccomp/AppArmor/SELinux profiles to block socket(AF_ALG, ...) for untrusted code.

How severe is CVE-2026-31431?

CVE-2026-31431 is rated HIGH (CVSS 3.1 score 7.8) with full High impact on Confidentiality, Integrity, and Availability. While the local attack vector limits remote exploitability, multi-tenant Linux environments (cloud, containers, shared hosting, CI runners) should treat it as a critical-priority remediation because any local user can escalate to root, breaking tenant isolation.

CVSS Score

7.8
HIGH(7.8)

EPSS Score

EPSS Score99.91%
EPSS Percentile100.0%

Dates

PublishedApril 22, 2026
Last ModifiedJuly 28, 2026
StatusAnalyzed
CVSS Versionv3.1

Quick Links

Back to CVE Database

Need Help With Vulnerability Management?

Our security experts can help you prioritize and remediate vulnerabilities effectively.

Get in Touch