Security Alert: CVE-2026-31431 Exposes Rootless Containers to 'Copy Fail'

Tue, 05 May 2026 15:09:57 +0000

Imagine a world where an unprivileged process, with no special rights, can reach into the kernel’s memory and alter critical system components. This isn’t science fiction; it’s the reality introduced by CVE-2026-31431, affectionately (and terrifyingly) dubbed “Copy Fail.” For those operating in the containerized world, especially with rootless setups, this vulnerability is a stark reminder that even seemingly robust isolation mechanisms can have hidden pathways to compromise.

The Core Problem: Kernel Memory Corruption via `AF_ALG`

CVE-2026-31431 is a high-severity local privilege escalation (LPE) vulnerability residing within the Linux kernel’s cryptographic subsystem, specifically the AF_ALG (userspace crypto API). The flaw lies in a logic error within the algif_aead module. At its heart, the exploit leverages the splice() system call to perform controlled, 4-byte writes into the kernel’s shared page cache. This seemingly small manipulation is enough to corrupt in-memory copies of critical setuid binaries, such as /usr/bin/su. The ultimate consequence? An unprivileged user can execute a corrupted setuid binary and gain root privileges.

Rootless on The Coders Blog

Security Alert: CVE-2026-31431 Exposes Rootless Containers to 'Copy Fail'

The Core Problem: Kernel Memory Corruption via AF_ALG

The Core Problem: Kernel Memory Corruption via `AF_ALG`