oss-security - Re: CVE-2026-31431: CopyFail: linux local privilege scalation

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <871pfxpf0v.fsf@gentoo.org>
Date: Wed, 29 Apr 2026 23:39:44 +0100
From: Sam James <sam@...too.org>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2026-31431: CopyFail: linux local privilege
 scalation

Jan Schaumann <jschauma@...meister.org> writes:

> Hi,
>
> This is currently making the rounds and looks pretty
> severe:
>
> https://copy.fail/
>
> A local privilege escalation vulnerability with a
> working PoC python script exploiting a logic flaw in
> the kernel crypto API (AF_ALG) affecting most Linux
> distributions.
>
> More detailed write-up:
> https://xint.io/blog/copy-fail-linux-distributions
>
> [...]

> Affected and fixed versions
> ===========================
>
> Issue introduced in 4.14 with commit
> 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 and fixed in
> 6.18.22 with commit
> fafe0fa2995a0f7073c1c358d7d3145bcc9aedd8
>
> Issue introduced in 4.14 with commit
> 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 and fixed in
> 6.19.12 with commit
> ce42ee423e58dffa5ec03524054c9d8bfd4f6237
>
> Issue introduced in 4.14 with commit
> 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 and fixed in
> 7.0 with commit
> a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5

To say it explicitly, all the kernels in-between before 6.18 aren't
fixed.

>
> https://git.kernel.org/stable/c/fafe0fa2995a0f7073c1c358d7d3145bcc9aedd8
> https://git.kernel.org/stable/c/ce42ee423e58dffa5ec03524054c9d8bfd4f6237
> https://git.kernel.org/stable/c/a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5
>
> ----
>
> PoC:
> https://github.com/theori-io/copy-fail-CVE-2026-31431/blob/main/copy_fail_exp.py
>
>
> Mitigation:
>
> # echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
> # rmmod algif_aead 

Brad Spengler has been pointing out that this won't work on a few common
enterprise kernels where CONFIG_CRYPTO_USER_API_AEAD=y (rather than m).

>
>
> -Jan

sam

Download attachment "signature.asc" of type "application/pgp-signature" (419 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.