CVE-2026-31431: Linux kernel algif_aead page-cache write to root (Copy Fail)

Exploited in the wild High 7.8 EPSS 98.1% Linux kernel

The AF_ALG AEAD interface (crypto/algif_aead.c) processed data in place even though source and destination come from different mappings, letting a local unprivileged user corrupt the page cache of files they can only read, such as SUID binaries, and become root. A public exploit and a Metasploit module were released on 29 April 2026, and Ubuntu notes it may also enable container escape. Linux 4.14 and later are affected; CISA added it to KEV on 1 May 2026.

Also known as “Copy Fail”.

• CVE-2026-31431CVE identifier
• 7.8CVSS 3.1 base score (high)
• 2026-05-01added to CISA's exploited list (US federal deadline 2026-05-15)
• 98.1%EPSS: chance of exploitation in the next 30 days (higher than 100% of CVEs)
• 2026-04-22published

What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms

Affected and fixed versions

Affected:

• Linux 4.14 through 5.10.253
• Linux 5.11 through 5.15.203
• Linux 5.16 through 6.1.169
• Linux 6.2 through 6.6.136
• Linux 6.7 through 6.12.84
• Linux 6.13 through 6.18.21
• Linux 6.19 through 6.19.11

Fixed in:

• Linux 5.10.254
• Linux 5.15.204
• Linux 6.1.170
• Linux 6.6.137
• Linux 6.12.85
• Linux 6.18.22
• Linux 6.19.12
• Linux 7.0

Am I affected?

uname -r
dpkg -l 'linux-image*' | grep ^ii   # Debian/Ubuntu
rpm -q kernel   # RHEL/Fedora/Amazon/SUSE (SUSE: rpm -q kernel-default)
grep -qE '^algif_aead ' /proc/modules && echo 'algif_aead loaded' || echo 'algif_aead not loaded'
dpkg -l kmod   # Ubuntu: kmod mitigation update (USN-8226-1)
canonical-livepatch status --verbose   # Ubuntu Livepatch

Patch it

Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.

sudo apt update
sudo apt upgrade
sudo reboot

sudo apt update
sudo apt upgrade
sudo reboot
# Ubuntu 26.04 is not affected.

sudo dnf upgrade kernel
sudo reboot
# RHEL 7: sudo yum update kernel
# no-reboot option where Red Hat ships kpatch for your stream (see restart):
# sudo dnf install "kpatch-patch = $(uname -r)"

sudo dnf upgrade --refresh kernel
sudo reboot

sudo zypper refresh
sudo zypper patch --category security
sudo reboot

# Amazon Linux 2023
sudo dnf upgrade --releasever=latest 'kernel*'
# Amazon Linux 2
sudo yum update kernel
sudo reboot

sudo pacman -Syu
sudo reboot

# as root
apk update
apk upgrade
reboot

not Linux

General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.

Fix status in Linux distributions

From the Debian security tracker, Ubuntu CVE tracker and Red Hat Security Data API, refreshed every few hours.

If you cannot patch yet

• Debian/Ubuntu (algif_aead is a module): echo 'install algif_aead /bin/false' | sudo tee /etc/modprobe.d/manual-disable-algif_aead.conf && sudo rmmod algif_aead 2>/dev/null; reboot if it stays loaded. Ubuntu's kmod update (USN-8226-1) applied this automatically. Some apps may lose hardware-accelerated crypto.
• RHEL (algif_aead is built in, cannot be blocklisted): add a boot argument, e.g. sudo grubby --update-kernel=ALL --args='initcall_blacklist=algif_aead_init' and reboot. Red Hat lists initcall_blacklist=af_alg_init or initcall_blacklist=crypto_authenc_esn_module_init as alternatives.

Related vulnerabilities

• CVE-2026-46300
• CVE-2025-39964

Sources

• CVE record CVE-2026-31431
• NVD CVE-2026-31431
• CISA KEV entry CVE-2026-31431
• Debian security tracker CVE-2026-31431
• Ubuntu CVE page CVE-2026-31431
• Red Hat CVE page CVE-2026-31431
• SUSE CVE page CVE-2026-31431
• Amazon Linux ALAS CVE page CVE-2026-31431
• Red Hat RHSB-2026-002 Copy Fail bulletin
• Ubuntu: Copy Fail fixes and mitigation
• Copy Fail disclosure site
• oss-security: Copy Fail disclosure
• linux-cve-announce: CVE-2026-31431
• Ubuntu Livepatch notice LSN-0121-1
• https://git.kernel.org/stable/c/893d22e0135fa394db81df88697fba6032747667
• https://git.kernel.org/stable/c/19d43105a97be0810edbda875f2cd03f30dc130c
• https://git.kernel.org/stable/c/961cfa271a918ad4ae452420e7c303149002875b
• https://git.kernel.org/stable/c/3115af9644c342b356f3f07a4dd1c8905cd9a6fc
• https://git.kernel.org/stable/c/8b88d99341f139e23bdeb1027a2a3ae10d341d82
• https://git.kernel.org/stable/c/fafe0fa2995a0f7073c1c358d7d3145bcc9aedd8

Page generated automatically from official sources on 2026-11-03 18:05 UTC and reviewed by an editor. Always confirm with your vendor's advisory.