CVE-2026-31431 – CopyFail

Since 2017, a vulnerability has been lurking in the Linux kernel that allows a local attacker without any privileges to write 4 bytes to arbitrary readable files. That sounds like a small thing – but it's enough for a full privilege escalation. The vulnerability was disclosed on April 29, 2026 under the name CopyFail (CVE-2026-31431).

This article explains what's happening, which systems are affected, and what the instant fix looks like on every major distribution.

What's Going On?

The problem lies in three components that together produce unexpected behavior:

• AF_ALG socket: An interface that allows userspace programs to access kernel crypto functions directly.
• splice() syscall: Transfers file cache pages directly into a scatterlist structure inside the kernel.
• authencesn algorithm: During in-place AEAD operations, writes 4 bytes to a location outside the intended output buffer – directly into the page cache.

A commit from 2017 (72548b093ee3) introduced this in-place optimization. The fix (a664bf3d603d) reverts AEAD operations back to out-of-place mode and cleanly separates source and destination scatterlists.

Am I Affected?

All kernels from version 4.14 up to and including 6.18.21 and 6.19.11 are vulnerable. This covers practically every production Linux installation from the past several years.

Quick check on any system:

# Show kernel version
uname -r

# Is the module already loaded?
lsmod | grep algif_aead

Instant Fix (All Distros)

Until a patched kernel is available, the following measure prevents the vulnerable module from being loaded. It is distribution-independent and takes effect immediately:

# Block the module permanently
echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif-aead.conf

# Unload the module if it's already loaded
rmmod algif_aead 2>/dev/null || true

# Verify
cat /etc/modprobe.d/disable-algif-aead.conf

Roll out to multiple servers at once (example using SSH config aliases):

# Deploy to all servers in parallel
for host in server1 server2 server3; do
  ssh "$host" 'echo "install algif_aead /bin/false" \
    > /etc/modprobe.d/disable-algif-aead.conf \
    && echo "OK: $HOSTNAME"' &
done
wait

Distro-Specific Notes

apt update && apt upgrade linux-image-$(uname -r)
# After reboot, remove the mitigation:
rm /etc/modprobe.d/disable-algif-aead.conf

apt update && apt upgrade linux-image-$(uname -r)
# After reboot and kernel update:
rm /etc/modprobe.d/disable-algif-aead.conf

apt update && apt upgrade pve-kernel-$(uname -r)
# Or use the Proxmox upgrade tool:
pveupgrade

dnf update kernel
# After reboot:
rm /etc/modprobe.d/disable-algif-aead.conf

pacman -Syu linux linux-headers
# After reboot, remove the mitigation:
rm /etc/modprobe.d/disable-algif-aead.conf

dnf update kernel
# After reboot:
rm /etc/modprobe.d/disable-algif-aead.conf

After the Kernel Update

Once a patched kernel is installed and the system has been rebooted, the temporary block must be removed – so that legitimate applications using AF_ALG AEAD continue to work:

# Verify the new kernel version
uname -r

# Remove the mitigation (only once the kernel is patched!)
rm /etc/modprobe.d/disable-algif-aead.conf

# The module block is now lifted

Sources & Further Reading

• copy.fail – Official disclosure page
• xint.io – CopyFail: Affected Linux Distributions
• oss-security mailing list – Full Disclosure
• Ubuntu Security Blog – Fixes available
• Debian Security Tracker – CVE-2026-31431
• AlmaLinux Blog – Copy Fail Patches Released
• Microsoft Security Blog – CVE-2026-31431 in Cloud Environments
• CERT-EU Security Advisory 2026-005