CVE-2026-31431: Local Privilege Escalation via Page Cache Corruption in Linux Kernel AF_ALG
LXer: Linux News [Unofficial]
May 1, 2026
CVE-2026-31431, colloquially known as "Copy Fail," is a critical logic flaw in the Linux kernel's Cryptographic API (specifically the algif_aead module). It allows an unprivileged local user to perform a deterministic, controlled 4-byte write into the read-only page cache of any accessible file on the system. By corrupting the in-memory representation of SUID binaries, an attacker achieves local privilege escalation to the root user and can successfully escape containerized environments.
Discussion in the ATmosphere