hypeorhack
← back

CVE-2026-31431

HIGH · 7.8 KEV EPSS 2.3%
hype LIKELY HACK · 72 hack

KEV + distro patches + PoC public; "CopyFail" branding inflates hype but real exploitation confirmed.

What: Linux kernel crypto/algif_aead in-place operation flaw allowing local privilege escalation (CVE-2026-31431, CVSS 7.8 HIGH, EPSS 0.8%).

Why it matters: KEV-listed as of 2026-05-01. Multiple distros patching urgently (Arch 6.19.12-1, AlmaLinux, Ubuntu). Public PoC circulating with "732-byte exploit" narrative. Kernel crypto subsystem affects all local users; privilege escalation to root confirmed in chatter.

Where it's seen: Cross-distro security advisories (Arch, AlmaLinux, Alpine, Ubuntu, Rocky, CentOS); Medium writeups; Spanish/multilingual coverage; community noting "clickbait" framing but confirming real LPE impact.

RISK: HIGH — Kernel LPE, KEV-listed, multiple distros patching, public PoC, affects all systems.

Generated by claude-haiku-4-5 from public posts and authoritative metadata. AI can make mistakes — verify against vendor advisories before acting. 5/2/2026, 1:51:41 PM

AttackerKB

view on attackerkb.com →

In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.

Public PoCs on GitHub 20 repos

  • nomi-sec/PoC-in-GitHub ★ 7687

    📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.

  • Mr-xn/Penetration_Testing_POC ★ 7330 · HTML

    渗透测试有关的POC、EXP、脚本、提权、小工具等---About penetration-testing python-script poc getshell csrf xss cms php-getshell domainmod-xss csrf-webshell cobub-razor cve rce sql sql-poc poc-exp bypass oa-getshell cve-cms

  • cdk-team/CDK ★ 4641 · Go

    📦 Make security testing of K8s, Docker, and Containerd easier.

  • 0xsyr0/OSCP ★ 3720 · PowerShell

    OSCP Cheat Sheet

  • theori-io/copy-fail-CVE-2026-31431 ★ 2904 · Python
Page 1 of 4

Articles & coverage 12 articles

  • Nine-year-old Linux kernel flaw enables reliable local privilege ...

    Security researchers at Theori have disclosed a high-severity local privilege escalation (LPE) vulnerability (CVE-2026-31431) in the Linux kernel. It’s a logic bug in the *authencesn* cryptographic template and allows an unprivileged local user to write 4 controlled bytes into the page cache of any readable file on a Linux system, and use that to gain root. The good news is that CVE-2026-31431 exp

  • CVE-2026-31431: Linux Kernel Crypto AEAD Vulnerability

    CVE-2026-31431 is a vulnerability in the Linux kernel's crypto algif\_aead subsystem involving in-place operation handling. A vulnerability has been identified in the Linux kernel's cryptographic subsystem, specifically within the algif\_aead module. The issue stems from complexity introduced by in-place operation handling in the AEAD (Authenticated Encryption with Associated Data) socket interfac

  • Copy Fail (CVE-2026-31431): Linux Kernel Privilege Escalation FAQ

    * [Skip to Main Navigation](https://www.tenable.com/blog/copy-fail-cve-2026-31431-frequently-asked-questions-about-linux-kernel-privilege-escalation#site-nav). * [Skip to Main Content](https://www.tenable.com/blog/copy-fail-cve-2026-31431-frequently-asked-questions-about-linux-kernel-privilege-escalation#block-tenable-content). * [Skip to Footer](https://www.tenable.com/blog/copy-fail-cve-20

  • Proof-of-concept exploit available for Linux 'Copy Fail' (CVE-2026-31431)

    - EDR - Endpoint detection and response. - XDR - Extended detection and response. - XDR with Next-Gen SIEM. - ITDR - Identity threat detection and response. - NDR - Network detection and response. + Explore managed detection and response with Sophos MDR. - MDR - Managed detection and response. + Protect your business around the clock with managed detection and response. # Proof-of-concept exploit

  • Why CVE-2026-31431 (Copy Fail) barely scratches Talos Linux

    # Exploit Fail: Why CVE-2026-31431 (Copy Fail) barely scratches Talos Linux. The Copy Fail exploit (CVE-2026-31431) makes a bold claim. Talos Linux doesn't have a python interpreter so we know that can't be right. We need to see how it works, if Talos is affected, and if similar exploits would work in the future. **tl;dr summary:** Copy Fail (CVE-2026-31431) does affect the kernel that ships with

Page 1 of 3
› NVD details 1 CWE ·1 vendor · 38 refs expand

Description

In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.

Weaknesses

Vendors

  • linux

Products

  • linux_kernel

References

Patches & fixes · 18
Exploits & PoCs · 4
Other · 16

Top posts driving the trend