🛡️ Threat Intelligence Report: Copy Fail (CVE-2026-31431) — Linux Kernel Privilege Escalation

1. Source Reports Table

2. Detailed Cross-Source Analysis

2.1 Converging Intelligence — Key Findings Across All 10 Sources

All 10 independent reports converge on the following points regarding CVE-2026-31431 ("Copy Fail"):

• Universal Impact: The vulnerability affects every mainstream Linux distribution shipped since July 2017, when kernel commit 72548b093ee3 introduced the vulnerable in-place AEAD optimization. Confirmed exploitable distributions include Ubuntu 24.04 LTS, Amazon Linux 2023, RHEL 10.1, SUSE 16, Debian (stable), Fedora, CloudLinux, and more.
• Trivial, Deterministic Exploitation: Unlike many kernel exploits that rely on race conditions or architecture-specific offsets, Copy Fail is a straight-line logic flaw. The 732-byte Python PoC (SHA-256: a567d09b15f6e4440e70c9f2aa8edec8ed59f53301952df05c719aa3911687f9) works unmodified across all affected distributions.
• In-Memory-Only Attack: The exploit corrupts the page cache of setuid binaries (e.g., /usr/bin/su) without modifying on-disk files. This completely evades traditional File Integrity Monitoring (FIM) tools such as AIDE and Tripwire.
• Container Escape: Because the Linux page cache is shared across the host, exploitation from within a container can corrupt binaries visible to the host and other containers, enabling container-to-host escape in Kubernetes and multi-tenant environments.
• Active Exploitation Confirmed: Microsoft Defender telemetry (report #6) confirms threat actors are actively scanning cloud instances and exploiting CVE-2026-31431 in the wild as of May 1, 2026.
• Patching Gap: While the mainline kernel was patched on April 1, 2026 (commit a664bf3d603d), many major distributions remained unpatched over 30 days later. Only rolling-release distributions (Debian sid, Arch Linux) and Debian security repositories have deployed fixes.

2.2 Diverging Perspectives

• Sidero Labs / Talos Linux (report #8) provides a notable counterpoint: Talos Linux is architecturally resistant to Copy Fail because it lacks a Python interpreter, has no interactive users, does not ship /usr/bin/su, and contains no setuid binaries on the host. This demonstrates that hardened, immutable OS designs significantly reduce exposure even when the kernel vulnerability exists.
• Microsoft (report #6) emphasizes cloud-wide lateral movement post-exploitation, including backdoor deployment and data exfiltration, extending the threat model beyond simple privilege escalation.

2.3 Historical Context — Evolutionary Lineage

Cross-source correlation reveals Copy Fail is the third generation of Linux page cache exploitation techniques:

Each iteration is more reliable, more portable, and harder to detect.

3. Executive Summary

Overview

CVE-2026-31431 ("Copy Fail") is a critical local privilege escalation (LPE) vulnerability in the Linux kernel's cryptographic subsystem (authencesn AEAD via algif_aead). Discovered by Xint Code and publicly disclosed on April 29, 2026, this flaw allows any unprivileged local user to gain root access on virtually every major Linux distribution shipped since 2017. A reliable, deterministic 732-byte Python proof-of-concept is publicly available and works unmodified across Ubuntu, Amazon Linux, RHEL, SUSE, Debian, Fedora, and others. The vulnerability also enables container escapes in shared-kernel environments, posing an existential threat to cloud, Kubernetes, CI/CD, and multi-tenant infrastructure.

Diagram — Attack/Method Overview

┌─────────────────────────────────────────────────────────────────────────────┐
│                        COPY FAIL ATTACK FLOW                                │
│                        CVE-2026-31431                                       │
├─────────────────────────────────────────────────────────────────────────────┤
│                                                                             │
│  ┌─────────────────────┐                                                    │
│  │ 1. LOCAL USER ACCESS │  (unprivileged, no special permissions needed)    │
│  └──────────┬──────────┘                                                    │
│             │                                                               │
│             ▼                                                               │
│  ┌─────────────────────────────────┐                                        │
│  │ 2. OPEN AF_ALG SOCKET           │  socket(AF_ALG, SOCK_SEQPACKET, 0)    │
│  │    Bind: authencesn(hmac(sha256))│                                       │
│  └──────────┬──────────────────────┘                                        │
│             │                                                               │
│             ▼                                                               │
│  ┌─────────────────────────────────────────────┐                            │
│  │ 3. SPLICE /usr/bin/su INTO PIPE → AF_ALG    │  splice() zero-copy       │
│  │    Page cache pages exposed to scatterlist   │                           │
│  └──────────┬──────────────────────────────────┘                            │
│             │                                                               │
│             ▼                                                               │
│  ┌─────────────────────────────────────────────────────┐                    │
│  │ 4. TRIGGER AEAD DECRYPTION                          │                    │
│  │    authencesn scratch-writes 4 bytes past boundary   │                   │
│  │    → Controlled overwrite into PAGE CACHE of su      │                   │
│  └──────────┬──────────────────────────────────────────┘                    │
│             │                                                               │
│             ▼                                                               │
│  ┌─────────────────────────────────────────────┐                            │
│  │ 5. EXECUTE /usr/bin/su                       │                           │
│  │    Kernel loads CORRUPTED page cache image   │                           │
│  │    → SHELLCODE EXECUTES WITH ROOT PRIVILEGES │                           │
│  └──────────┬──────────────────────────────────┘                            │
│             │                                                               │
│             ▼                                                               │
│  ┌──────────────────────────────┐    ┌──────────────────────────────────┐   │
│  │ 6a. ROOT SHELL ON HOST       │    │ 6b. CONTAINER ESCAPE             │   │
│  │     Full system compromise   │    │     Shared page cache = host     │   │
│  └──────────────────────────────┘    │     access across containers     │   │
│                                      └──────────────────────────────────┘   │
│                                                                             │
│  ● No race condition   ● No kernel offsets   ● No disk artifacts           │
│  ● 732 bytes exploit   ● Python 3.10+ only   ● Works since 2017 kernels   │
└─────────────────────────────────────────────────────────────────────────────┘

Attribution & Threat Actor Description

• Discoverer: Xint Code Research Team — responsible disclosure to the Linux kernel security team on March 23, 2026. Published the original technical write-up and PoC at copy.fail.
• Active Threat Actors: Microsoft Defender telemetry confirms unnamed threat actors are actively exploiting the vulnerability in the wild as of May 1, 2026. These actors are:
  • Scanning for vulnerable Linux cloud instances (Azure, AWS, GCP)
  • Using automated exploitation scripts
  • Targeting high-uptime systems missing patches
  • Deploying backdoors and exfiltrating data post-compromise
  • Moving laterally between VMs and containers
• No specific APT attribution has been published as of May 3, 2026. The exploit's trivial nature and public availability make it accessible to the full spectrum of threat actors, from script kiddies to nation-state groups.

4. Technical Details

4.1 Vulnerability Analysis

4.2 Exploit Characteristics

4.3 Technical Root Cause Deep Dive

The vulnerability exists in the interaction between three Linux kernel components:

1. AF_ALG Socket Interface: Provides userland access to the kernel's cryptographic subsystem. Any unprivileged user can open an AF_ALG SEQPACKET socket and bind it to cryptographic algorithms.

2. splice() System Call: Enables zero-copy transfer of file pages into pipes. When a user splices a readable file (e.g., /usr/bin/su) into a pipe, the kernel exposes page cache references (not copies) to the pipe buffer.

3. authencesn AEAD Algorithm: During decryption, the 2017 in-place optimization uses the destination buffer as scratch space. The algorithm writes 4 bytes (derived from attacker-controlled AAD data) past the intended boundary — into the spliced tag region, which is a live page cache page of the target file.

The result: the attacker writes 4 controlled bytes into the in-memory executable image of a setuid binary. When any process executes that binary, the corrupted page cache version runs with root privileges.

4.4 Affected Linux Distributions (Confirmed Exploitable)

Fixed Kernel Versions: 7.0, 6.19.12, 6.18.22+

4.5 Infrastructure Analysis — Cloud & Container Impact

Copy Fail has unique implications for cloud and container environments:

• Shared Page Cache: In Linux, the page cache is a single shared resource for the entire host. Containers sharing a base image with the host also share page cache entries. Exploitation from within a container corrupts the page cache visible to the host and all co-located containers.
• Kubernetes: Any pod with local code execution capability (even unprivileged) can exploit Copy Fail to escape to the host, compromising the node and potentially the entire cluster.
• CI/CD Pipelines: Build runners that execute untrusted code are high-risk targets.
• Multi-tenant SaaS: Any service executing user-provided code on shared Linux infrastructure is vulnerable.
• AI/ML Platforms: Code execution environments (Jupyter notebooks, model training runners) on shared infrastructure are exposed.

Microsoft Defender telemetry confirms threat actors are actively scanning for and exploiting vulnerable cloud instances, with post-exploitation activity including:

• Backdoor deployment
• Sensitive data exfiltration
• Lateral movement between VMs and containers
• Disabling security controls via compromised root access

5. Detection Opportunities

5.1 Behavioral Detection Rules

5.2 Falco / Sysdig Detection Rule

- rule: Copy Fail - AF_ALG Socket from Unprivileged User
  desc: Detect AF_ALG socket creation (potential CVE-2026-31431 exploitation)
  condition: >
    evt.type = socket and
    evt.arg.domain = AF_ALG and
    not proc.is_suid_root and
    not user.name in (root, dm-crypt-service)
  output: >
    AF_ALG socket created by unprivileged user
    (user=%user.name proc=%proc.name pid=%proc.pid container=%container.name)
  priority: CRITICAL
  tags: [CVE-2026-31431, copy-fail, privilege-escalation]

5.3 Auditd Rules

# Monitor AF_ALG socket creation (protocol family 38)
-a always,exit -F arch=b64 -S socket -F a0=38 -k copyfail_af_alg
# Monitor splice() calls targeting setuid binaries
-a always,exit -F arch=b64 -S splice -F exe=/usr/bin/su -k copyfail_splice
-a always,exit -F arch=b64 -S splice -F exe=/usr/bin/passwd -k copyfail_splice

5.4 Detection Limitations

Multiple sources confirm that traditional forensics and FIM are ineffective against Copy Fail:

• No on-disk artifacts — file on disk is never modified
• No inotify triggers — kernel does not notify file watchers of page cache changes
• No persistence across reboot — forensic imaging of disk will miss exploitation
• Short attack window — cache eviction removes evidence
• Only real-time runtime monitoring (Sysdig, Falco, eBPF-based tools) or AF_ALG syscall auditing can detect the attack

6. Conclusion

CVE-2026-31431 ("Copy Fail") represents one of the most impactful Linux kernel vulnerabilities discovered in the last decade. Its combination of universal applicability (every major distribution since 2017), deterministic exploitation (no race conditions or offsets), stealth (in-memory only, no disk traces), and container escape capability make it a top-priority threat for any organization running Linux infrastructure.

The 30+ day gap between the mainline kernel patch and distribution-level deployments has created a critical exposure window that threat actors are actively exploiting. Organizations must immediately apply mitigations (blacklisting algif_aead, seccomp policies) while accelerating kernel patching across all Linux assets, with particular urgency for cloud, container, CI/CD, and multi-tenant environments.

The evolutionary progression from Dirty Cow → Dirty Pipe → Copy Fail demonstrates that Linux page cache manipulation remains a fertile and dangerous attack surface requiring both kernel-level fixes and runtime monitoring investments.

7. Indicators of Compromise (IoC List)

Network / File-Based IoCs

Behavioral IoCs

8. MITRE ATT&CK Techniques

Report generated 2026-05-03 via TI Mindmap HUB cross-source correlation. All intelligence derived from 10 open-source and vendor publications.