CVE-2026-31431 (Copy Fail): Deterministic Linux LPE via AF_ALG Cryptographic Subsystem
A deterministic local privilege escalation flaw in the Linux kernel's algif_aead module allows unprivileged attackers to inject shellcode into page-cached setuid binaries and achieve root access across all major distributions since 2017.
Attack Brief
TargetLinux kernel (AF_ALG interface, algif_aead module); affects Ubuntu, Amazon Linux, RHEL, Debian, SUSE, AlmaLinuxVectorLocal privilege escalation via AF_ALG socket interface and splice() system call to corrupt kernel page cache of setuid-root binariesAttributionresearcher disclosure
Technical Details
CVE IDsCVE-2026-31431MITRE ATT&CKT1548.004IoCs/usr/bin/susudopasswdAffectedLinux kernel versions 4.14 through 6.19.12; affected by in-place optimization introduced in commit 72548b093ee3 (2017); fixed by commit a664bf3d603d
Impact
SectorsCloud infrastructureContainer orchestrationCI/CD platformsMulti-tenant hostingConfirmed DamagePrivilege escalation to root (UID 0); container escape; multi-tenant host compromise; CI/CD pipeline compromise; no disk-level artifacts due to page-cache-only corruptionGeographyGlobal
Mitigation
PatchesLinux Foundation advisory with kernel updatesUpstream Linux kernel stable branch patches (commit a664bf3d603d)WorkaroundsDisable algif_aead module until patches applied; Palo Alto Networks protections available via Next-Generation Firewall with Advanced Threat Prevention, Cortex Cloud, Cortex XDR, and XSIAM