Copy Fail (CVE-2026-31431): How Four Bytes in the Page Cache Can Grant Root on Linux

Forum topic · ✨步子哥 · 2026-05-01

Summary

Copy Fail (CVE-2026-31431) is a Linux kernel privilege escalation vulnerability that lets an unprivileged user gain root without write access to any file on disk. The exploit chains five kernel mechanisms: (1) setuid binaries, which run with file-owner privileges and trust that their on-disk contents cannot be modified by normal users; (2) splice(), a zero-copy API that attaches page cache pages to a pipe by reference via pipe_buffer, without copying data; (3) the AF_ALG socket interface, which feeds user data into the kernel crypto framework; (4) algif_aead's in-place optimization (introduced in 2017), which assumes input and output buffers are writable and reuses the same memory; and (5) the authencesn AEAD template, which writes a 4-byte extended sequence number into what it believes is the output buffer. Because the buffer actually points to a read-only page cache page, the write corrupts cached file contents even if authentication fails with EBADMSG, since the write occurs before tag verification. An attacker repeatedly modifies offsets in a readable setuid binary's cached image, then executes it to obtain root, leaving the disk file untouched. The fix removes the in-place logic in algif_aead; interim mitigations include restricting AF_ALG.

Overview

Copy Fail (CVE-2026-31431) is a Linux kernel privilege escalation vulnerability. In short, it allows an ordinary user—with no write permission on any file—to temporarily corrupt the in-memory (page cache) representation of files that should be untouchable, then achieve arbitrary code execution and obtain root privileges. Nothing on disk changes; the attack lives entirely in memory.

Key Background Mechanisms

1. Page cache

To avoid slow disk I/O, the kernel caches file contents in physical memory pages. Programs often read from these cached copies rather than the disk. If the cached copy is modified while the disk file stays intact, the system still executes the corrupted content.

2. setuid trust model

setuid binaries run with the privileges of their owner (usually root). Examples like passwd must write to root-only files such as /etc/shadow. The model's security rests on the assumption that normal users cannot modify the binary on disk—Copy Fail attacks exactly this assumption by poisoning the cached image instead.

3. splice() zero-copy

splice() moves data inside the kernel without copying: it attaches page cache pages directly to a pipe's pipe_buffer structures, which hold only references to struct page. Downstream consumers operate on the original page cache pages—not a private copy.

4. AF_ALG and AEAD

AF_ALG is a socket address family letting user programs hand data to the kernel crypto framework for hashing, encryption, and authenticated encryption. The exploit targets AEAD (Authenticated Encryption with Associated Data), where plaintext/ciphertext is encrypted and associated data (AD) is authenticated in the clear.

5. algif_aead's in-place optimization

A 2017 performance optimization allowed input and output to share the same buffer, assuming the caller's buffer is writable. When the buffer comes from splice(), it actually points to a read-only page cache page—and algif_aead does not check its origin.

6. The fatal write in `authencesn`

The authencesn AEAD template (authenc + extended sequence number, used in IPsec ESP) writes a 4-byte (32-bit) sequence number into the output buffer at an offset roughly equal to AD length plus ciphertext length. Due to in-place handling, that write lands directly on the page cache page. Critically, this write happens before authentication tag verification—even if the kernel returns EBADMSG, the cache is already polluted.

Attack Chain

1. Attacker selects a readable, non-writable file—e.g., a setuid binary. 2. splice() connects parts of the file to a pipe; pipe_buffer references page cache pages directly (no copy). 3. Pipe data is submitted via AF_ALG as AEAD input; algif_aead processes it in-place. 4. authencesn writes the 4-byte sequence number into the page cache page. The attacker repeats with different offsets to precisely patch the binary's cached image. 5. The attacker executes the setuid binary. The disk file is unchanged and permissions are intact, but the cached version has been modified—granting root.

The whole process modifies no disk file and touches no permissions: pure in-memory "living off the land."

Mitigation

Apply the kernel patch: the fix removes the in-place logic in algif_aead, separating input and output buffers so writes can never land in the (read-only) input buffer.
Interim mitigation: restrict or disable the AF_ALG interface and related modules if upgrading is not immediately possible.

Takeaway

Copy Fail is a reminder that performance optimizations—zero-copy references plus in-place crypto—must respect read-only boundaries and trust models. The wall between an ordinary user and root can be shaken by exactly four bytes.

------

References

1. Linux kernel official documentation on splice() zero-copy mechanics. 2. AF_ALG socket interface and AEAD framework technical documentation (kernel crypto subsystem). 3. Analysis of the authencesn template in IPsec (2017 kernel optimization change records). 4. Security research on the setuid permission model. 5. Kernel patch notes for Copy Fail / CVE-2026-31431 (page cache and pipe_buffer reference mechanisms).