CVE-2026-31431: 
Docker vulnerability analysis and mitigation

CVE-2026-31431, dubbed "Copy Fail", is a local privilege escalation (LPE) vulnerability in the Linux kernel's crypto/algif_aead subsystem. It stems from a flawed in-place encryption/decryption optimization introduced in commit 72548b093ee3, which incorrectly assumed source and destination buffers could share the same mapping — enabling page cache corruption and ultimately root access. The vulnerability affects Linux kernel versions from approximately 4.14 through 6.19.11 (and 6.12.x through 6.12.84, 6.18.x through 6.18.21), spanning kernels shipped since 2017. It was publicly disclosed on April 22, 2026, with a CVSS v3.1 base score of 7.8 (High) (Github Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-669 (Incorrect Resource Transfer Between Spheres) and CWE-1288 (Improper Validation of Consistency within Input). The vulnerability exists in the algif_aead kernel module, which exposes AEAD (Authenticated Encryption with Associated Data) operations via the AF_ALG socket interface. Commit 72548b093ee3 introduced in-place operation logic that incorrectly handled cases where source and destination buffers come from different memory mappings, leading to deterministic page cache corruption. An unprivileged local user can open an AF_ALG socket, craft a specific AEAD encryption/decryption request, and trigger the page cache write primitive to overwrite arbitrary read-only kernel or filesystem pages — ultimately achieving root privilege escalation. The fix reverts the in-place logic and restores out-of-place operation, copying associated data directly (Github Advisory, lore.kernel.org). A public Python PoC exploit of only 732 bytes was released, demonstrating reliable exploitation across all major Linux distributions (theori-io PoC).

Successful exploitation allows any local user with access to the AF_ALG socket interface to escalate privileges to root, achieving full confidentiality, integrity, and availability compromise of the affected system. The vulnerability breaks container isolation when containers share the host kernel, enabling container escape scenarios in Kubernetes and Docker environments. Given the breadth of affected kernel versions (2017–2026), virtually every major Linux distribution — including Ubuntu, Debian, RHEL, AlmaLinux, SUSE, Amazon Linux, and others — was affected, exposing cloud infrastructure, enterprise servers, and embedded systems to complete system takeover (Microsoft Security Blog, Feedly Executive Summary).

CVE-2026-31431 is actively exploited in the wild and was added to the CISA Known Exploited Vulnerabilities (KEV) catalog on May 1, 2026, with a federal agency remediation deadline of May 15, 2026 (CISA KEV). A functional Python exploit (copy_fail_exp.py) was publicly released by theori-io, tested against Ubuntu, Amazon Linux, RHEL, and SUSE (theori-io PoC). A Metasploit module (cve_2026_31431_copy_fail.rb) was also merged into the framework (Metasploit PR). The EPSS score is approximately 2.19% (85th percentile). Malware families including Multiverze, Kill Switch, and Shai-Hulud have been observed weaponizing this vulnerability (Feedly Threat Intel). The exploit was notably described as requiring only 732 bytes of Python and achieving 100% reliability across affected distributions (copy.fail).

1. Reconnaissance: Identify a target Linux system running a kernel version between 4.14 and 6.19.11 (or 6.12.x < 6.12.85, 6.18.x < 6.18.22). Confirm the AF_ALG socket interface is accessible (available to unprivileged users by default on most distributions).
2. Obtain local access: Gain a low-privileged shell on the target system (e.g., via SSH, web shell, or container breakout entry point).
3. Prepare exploit: Download or write the 732-byte Python exploit (e.g., copy_fail_exp.py from the theori-io repository). No compilation or special dependencies are required beyond Python 3.
4. Open AF_ALG socket: The exploit opens an AF_ALG socket of type aead and binds it to a supported AEAD algorithm (e.g., gcm(aes)).
5. Trigger page cache corruption: Craft a specific AEAD encryption/decryption request that exploits the in-place operation bug, causing the kernel to write attacker-controlled data into a read-only page cache page (e.g., a setuid binary or /etc/passwd).
6. Overwrite privileged file: The page cache corruption allows overwriting the contents of a privileged file (such as /usr/bin/sudo or /etc/passwd) with attacker-controlled content, without triggering standard write permission checks.
7. Achieve root: Execute the modified binary or leverage the overwritten file to obtain a root shell. The exploit is reported as deterministic and does not require kernel ASLR bypass or heap spray (theori-io PoC, copy.fail, Metasploit Module).

• Network: Unusual outbound connections from systems shortly after local user activity on AF_ALG sockets; lateral movement traffic originating from previously low-privileged accounts.
• Process: Unexpected privilege escalation events — processes spawned by non-root users running as UID 0; child processes of web servers or container runtimes executing shells (e.g., /bin/bash, /bin/sh) as root.
• File System: Unexpected modification timestamps on setuid binaries (e.g., /usr/bin/sudo, /usr/bin/passwd) or /etc/passwd//etc/shadow without corresponding package manager activity; new SUID/SGID files created in unusual locations.
• Logs: Kernel audit logs (auditd) showing AF_ALG socket creation (socket(AF_ALG, ...)) by non-root users followed immediately by privilege escalation; dmesg or kernel logs showing page cache inconsistency warnings.
• YARA/Signatures: YARA rules targeting the exploit script pattern have been published by Neo23x0/signature-base (commit 3c2986014c0a05187d237c0913804eff980192c9) and are available at expl_copy_fail_cve_2026_31431.yar (Neo23x0 Signature Base).
• Detection Tools: Splunk, Elastic Security, and Datadog have published detection rules and agent-based detections for Copy Fail exploitation patterns (Splunk Blog, Elastic Security Labs).

Patch: Apply kernel updates containing the fix (reverting commit 72548b093ee3). Fixed versions include: 5.10.254+, 5.15.204+, 6.1.170+, 6.6.137+, 6.12.85+, 6.18.22+, 6.19.12+. Major distributions have released patches: Ubuntu (USN-8226-1 and subsequent), Debian (linux 6.12.85+1), RHEL 8/9/10 (RHSA-2026:13565 through multiple advisories), AlmaLinux, Rocky Linux, SUSE, Amazon Linux, and others (Red Hat Bugzilla, Ubuntu Blog).

Workarounds (if patching is not immediately possible):

• Block access to AF_ALG sockets for unprivileged users using a BPF LSM policy, seccomp filter, or by loading a kernel module that restricts socket(AF_ALG, ...) calls.
• Use Kubernetes Pod Security Standards (restricted profile) or seccomp RuntimeDefault to limit AF_ALG socket access in containerized environments.
• Live patching solutions (e.g., CloudLinux KernelCare, SUSE Live Patching, Ubuntu Livepatch) are available for patching without reboot (CloudLinux Blog).
• CISA required federal agencies to remediate by May 15, 2026.

The vulnerability generated extraordinary media and community attention, described by Wired as "dangerous new Linux exploit gives attackers root access to countless computers" and by Ars Technica as "the most severe Linux threat in years" (Wired, Ars Technica). Microsoft published a detailed threat intelligence blog post on May 1, 2026, and again on May 8 covering the related DirtyFrag vulnerability (Microsoft Security Blog). The Theori research team who published the PoC noted the exploit's unusual reliability and simplicity. Security researchers on social media highlighted the irony that a performance optimization introduced in 2017 became a nine-year-old root exploit. The vulnerability also spawned a dedicated website (copy.fail) and triggered a broader discussion about Linux kernel security processes, including a proposal for an emergency "killswitch" mechanism for vulnerable kernel functions (Help Net Security). The disclosure also prompted discovery of related vulnerabilities: DirtyFrag (CVE-2026-43284/CVE-2026-43500) and Fragnesia (CVE-2026-46300), all exploiting the same page cache attack surface.