[Security Notice] Linux Kernel Local Privilege Escalation Vulnerability Advisory (CVE-2026-31431)

Forwarded by LightNode | Original source: Tencent Cloud Security Center | April 30, 2026

The following is a security advisory from Tencent Cloud Security Center. As a cloud infrastructure provider, LightNode is sharing this notice to help our users stay informed and take timely action to protect their systems.

Dear Users,

The Tencent Cloud Security Center has detected a disclosed local privilege escalation vulnerability in the Linux Kernel, assigned CVE-2026-31431, codenamed "Copy Fail". This vulnerability allows a local low-privileged attacker to exploit the AF_ALG cryptographic interface combined with the splice() system call to write 4 bytes of controlled data into the page cache of any readable file, and subsequently gain root privileges by tampering with setuid binaries.

To prevent impact to your services, we recommend that you conduct a security self-check promptly. If you are within the affected scope, please apply the fix as soon as possible to avoid exploitation by external attackers.

Vulnerability Details

The Linux Kernel is the most widely used open-source operating system kernel in the world, serving as the core component of Linux systems and responsible for managing hardware resources, process scheduling, memory management, file systems, network functionality, and other low-level tasks.

In the combined implementation of the Linux kernel's authencesn encryption template and the algif_aead module, an in-place operation optimization was introduced in 2017 (commit 72548b093ee3) in the AEAD decryption path of AF_ALG sockets, which directly links page cache pages passed via splice() into the writable output scatterlist. The authencesn algorithm, when implementing IPsec Extended Sequence Number (ESN) support, writes 4 bytes of data at the offset assoclen + cryptlen within the receive buffer as temporary storage during decryption. When AF_ALG triggers the decryption operation via recvmsg(), this write crosses the receive buffer boundary and directly overwrites the page cache pages linked behind it — allowing controlled 4-byte tampering of the page cache of any readable file. This enables a local low-privileged attacker to obtain root privileges by tampering with the page cache content of setuid programs (e.g., /usr/bin/su), with no race condition or retries required. Furthermore, this write does not trigger dirty page writeback to disk, enabling persistent privilege escalation.

The vulnerability details and a proof-of-concept (PoC) are now publicly available.

Risk Level

High Risk

Vulnerability Risk

A local attacker exploiting this vulnerability can directly obtain root privileges by tampering with the page cache content of any readable file on the system (e.g., setuid programs such as /usr/bin/su), without requiring race conditions or retries. The write does not trigger dirty page writeback to disk, enabling persistent privilege escalation.

Affected Versions

Affected commit range: 72548b093ee3 ≤ commit < a664bf3d603d

Currently known affected operating systems and versions:

Ubuntu 25.10
Ubuntu 24.04 LTS
Ubuntu 22.04 LTS
Ubuntu 20.04 LTS
Ubuntu 18.04 LTS
Amazon Linux 2023
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 9
Red Hat Enterprise Linux 8
SUSE 16

Secure Version

commit ≥ a664bf3d603d

Detection Methods

bash

# Check kernel version
uname -r

# Check if the kernel configuration is enabled (recommended)
grep CONFIG_CRYPTO_USER_API_AEAD /boot/config-$(uname -r)

Note: Three outcomes are possible:

CONFIG_CRYPTO_USER_API_AEAD=n — Completely disabled; not affected; no action needed.
CONFIG_CRYPTO_USER_API_AEAD=y — Statically compiled into the kernel; not visible via lsmod, but affected. No mitigation available; kernel upgrade required (e.g., all RHEL/CentOS versions).
CONFIG_CRYPTO_USER_API_AEAD=m — Module mode; visible via lsmod; affected if loaded. Mitigation steps below can be applied.

bash

# Check if the affected module is loaded
lsmod | grep algif

# Check if AF_ALG socket can be created
python3 -c "import socket; socket.socket(38,5,0); print('VULNERABLE')"

Remediation Recommendations

1. The official patch and fixed version have been released. Evaluate your exposure and upgrade to the secure version: https://git.kernel.org/stable/c/a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5

2. For Ubuntu, Debian, RHEL/CentOS, and SUSE users — official distribution security updates have not yet been released. Please monitor the following advisories:

3. Mitigation steps:

bash

# Disable the kernel module
echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif-aead.conf

# Unload the already-loaded module
rmmod algif_aead 2>/dev/null

Note: For systems where the module is statically compiled into the kernel (e.g., all RHEL/CentOS versions), this mitigation may not be effective. Applying the official kernel patch is strongly recommended.

bash

# Verification
python3 -c 'import socket; s=socket.socket(38,5,0); (s.bind(("aead", "authencesn(hmac(sha256),cbc(aes))")) or print("Not mitigated")) if s else None' 2>/dev/null || echo "Mitigated"

4. Container environment hardening — Block AF_ALG socket creation (family=38) via seccomp:

json

"syscalls": [{
  "names": ["socket"],
  "action": "SCMP_ACT_ERRNO",
  "args": [{"index": 0, "value": 38, "op": "SCMP_CMP_EQ"}]
}]

Reminder: Please back up your data before performing any kernel upgrades to avoid unexpected issues.

References

This notice is forwarded by LightNode for informational purposes. Original advisory issued by Tencent Cloud Security Center on April 30, 2026.

LightNode API Doc Is Now Public

अन्य लेखहरू