CopyFail Linux Kernel AEAD Flaw Enables Local Privilege Escalation

Researchers disclosed CVE-2026-31431, dubbed CopyFail, a high-severity local privilege-escalation flaw in the Linux kernel's crypto subsystem affecting the algif_aead module through the AF_ALG socket interface. The bug was introduced in Linux 4.14 by commit 72548b093ee3, which added in-place AEAD handling in algif_aead.c; because source and destination buffers came from different memory mappings, the change created a path to memory corruption. The oss-sec disclosure said an unprivileged local attacker could exploit the flaw with a working Python proof of concept to gain a controlled page-cache write primitive against readable files.

That primitive could let attackers tamper with read-only files or setuid executables, potentially leading to privilege escalation or code execution. The issue has been fixed by reverting to out-of-place operation while preserving associated-data copying, with patches released in stable kernels 6.18.22, 6.19.12, and 7.0. Public advisories rate the flaw CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and recommend applying the stable kernel updates, restricting access to AF_ALG, and disabling or unloading the algif_aead module where it is not required.