PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2026-31431] Copy Fail: Universal Linux Local Privilege Escalation Vulnerability

wiz.io | vulnerability | CVE-2026-31431 | #privilege-escalation | #linux-kernel | #vulnerability | #cve-2026-31431 | #container-escape | #copy-fail
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Copy Fail (CVE-2026-31431): an algif_aead flaw lets unprivileged users write 4 bytes into the page cache of any readable file via AF_ALG and splice(), escalating to root on kernels since 2017.
CVE
CVE-2026-31431
Published
Collected

Related coverage

High · vulnerability · bugcrowd.com
What we know about Copy Fail (CVE-2026-31431)
Copy Fail (CVE-2026-31431) is a Linux kernel LPE zero-day since 2017: an algif_aead logic flaw grants root and container escape; a public 732-byte exploit was found by AI in an hour.
research · github.com
Infinity Core: Linux Kernel Core Subsystems LPE and Container Escape Research
Unlike most modern Linux kernel exploits that depend on networking, eBPF, or unprivileged user namespaces, these vulnerabilities reside in fundamental kernel core subsystems, rendering standard container sandboxes and Android application domain restrictions ineffective against local privilege escalation.
High · vulnerability · codeberg.org
cowcups: CUPS cups-fontpath Local Privilege Escalation (LPE) to Root PoC
Demonstrates an effective local root privilege escalation chain in default CUPS environments by abusing printer discovery and Ghostscript font search paths.
vulnerability · volexity.com
[CVE-2026-104935] A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days
# A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days October 13, 2026 Charlie Gardner, Sean Koessel, Steven Adair, and Volexity Volcano Team **_Volexity...
vulnerability · idnsec.com
[CVE-2025-39964] How I Found a $113,337 AF_ALG Linux Local Privilege Escalation Before Copy Fail
Write-up of CVE-2025-39964, an AF_ALG race condition in the Linux kernel enabling an out-of-bounds scatterlist write. The exploit overwrites core_pattern for root and a Docker container escape.
High · vulnerability · nebusec.ai
IonStack part II: GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years
A 15-year-old Linux kernel stack use-after-free was turned into reliable local privilege escalation and container escape, affecting essentially every unpatched major distribution.
Back