CVE-2026-31431: Local Privilege Escalation via Page Cache Corruption in Linux Kernel AF_ALG

Vulnerability ID: CVE-2026-31431

CVSS Score: 7.8

Published: 2026-04-22

CVE-2026-31431, colloquially known as "Copy Fail," is a critical logic flaw in the Linux kernel's Cryptographic API (specifically the algif_aead module). It allows an unprivileged local user to perform a deterministic, controlled 4-byte write into the read-only page cache of any accessible file on the system. By corrupting the in-memory representation of SUID binaries, an attacker achieves local privilege escalation to the root user and can successfully escape containerized environments.

TL;DR

A logic flaw in the Linux kernel's AF_ALG socket interface allows unprivileged users to overwrite the page cache of SUID binaries via the splice() system call, yielding deterministic Local Privilege Escalation (LPE) and container escapes.

⚠️ Exploit Status: WEAPONIZED

Technical Details

CWE ID : CWE-669

Attack Vector : Local

CVSS Score : 7.8

EPSS…