CVE-2026-31431 (Copy Fail): Linux Page Cache Privilege Escalation via splice() and AF_ALG

Forum topic · ✨步子哥 · 2026-05-01

Summary

CVE-2026-31431, nicknamed 'Copy Fail', is a Linux kernel vulnerability that allows an unprivileged user to gain root privileges without modifying any file on disk. The attack abuses the separation between a file's on-disk contents and its in-memory page cache copy. Using splice(), the attacker attaches read-only page cache pages of a setuid-root program to a pipe, then submits the pipe data to the kernel's AF_ALG crypto interface. The algif_aead handler performs an in-place optimization assuming buffers are writable, and the authencesn template writes a 4-byte extended sequence number into the shared memory before tag verification—even failed decryption attempts pollute the cache. By repeating the operation at precise offsets, an attacker surgically patches the cached image of a setuid binary and executes it to obtain root, leaving no disk traces and evading file-integrity monitoring. Mitigation: apply the official kernel patch that removes the algif_aead in-place logic, or disable AF_ALG modules until upgrade.

This post explains CVE-2026-31431 ("Copy Fail"), a Linux kernel privilege escalation that rewrites a file's in-memory page cache copy without ever touching the disk.

Background

Page cache: Linux caches file contents in memory (typically 4KB pages) for performance. Programs often read the cached copy, not the disk itself.
Setuid: Programs marked with the setuid bit (e.g., passwd) temporarily run with the file owner's (usually root) privileges. The security model assumes non-privileged users cannot modify these files—but the page cache can be a bypass.
splice(): A zero-copy mechanism that attaches page cache pages directly to pipe_buffer structures (references, not copies) for high-throughput piping.
AF_ALG / AEAD: The kernel's crypto socket interface, exposing authenticated encryption with associated data (AEAD) to user space.

The Bug Chain

1. The attacker selects a readable, non-writable target, typically a setuid-root binary. 2. splice() attaches its page cache pages to a pipe. 3. The pipe data is submitted to the AF_ALG AEAD interface. 4. algif_aead (changed in 2017 to support in-place input/output buffers) assumes the buffer is writable—but a pipe_buffer points to read-only page cache pages. 5. The authencesn template (authenc + extended sequence number, used in IPsec ESP contexts) writes a 4-byte sequence number at an offset after the associated data and ciphertext length, directly into the page cache page. 6. Critically, this write occurs before authentication tag verification: even a failed decryption (returning EBADMSG) pollutes the cache. 7. By repeating requests with controlled offsets, the attacker patches the cached image of the setuid binary (e.g., jump instructions, conditionals), then executes it to obtain root.

The attack is entirely "living off the land": no disk modification, no permission changes, no file-monitoring triggers.

Mitigation

Best: Update the kernel—the official patch removes the algif_aead in-place logic, forcing separate input/output buffers so writes never land on page cache pages.
Temporary: Disable AF_ALG-related kernel modules or restrict access to the interface.

The takeaway: performance optimizations that relax memory write boundaries can silently break the kernel's trust model—page cache integrity is as important as on-disk integrity.