Summary
| Vulnerability Name | Linux Kernel Copy Fail Local Privilege Escalation (CVE-2026-31431) |
| Released on | April 30, 2026 |
| Affected Component | Linux Kernel |
| Affected Version |
• Ubuntu 24.04 (LTS, 6.17.0-1007-aws and earlier)
• Amazon Linux 2023 (6.18.8-9.213.amzn2023 and earlier) • Red Hat Enterprise Linux 10 • Red Hat Enterprise Linux 9 • Red Hat Enterprise Linux 8 • SUSE 16 (6.12.0-160000.9-default and earlier) • Debian/Arch/Fedora/Rocky/Alma/Oracle and other distributions with kernel versions from the same period • Affected kernel commit range: commit 72548b093ee3 ≤ version < commit a664bf3d603d |
| Vulnerability Type | Privilege escalation |
| Exploitation Condition | 1. User authentication: required. 2. Preconditions: default configurations. 3. Trigger mode: local. |
| Impact | Exploitation difficulty: medium. Local low privileges are required. Severity: critical. This vulnerability enables attackers to escalate their privileges to root. |
| Official Solution | Available |
About the Vulnerability
Component Introduction
The Linux kernel is an open-source operating system kernel and the core component of the Linux operating system. It is responsible for managing computer hardware resources, and provides various system services such as process management, memory management, file system management, and device drivers.
Vulnerability Description
On April 30, 2026, Sangfor FarSight Labs received notification of the local privilege escalation vulnerability in the Linux kernel (CVE-2026-31431), classified as critical in threat level.
Specifically, the algif_aead component in the Linux kernel crypto subsystem contains a logic flaw when handling in-place operations for the AEAD interface. This issue is related to commit 72548b093ee3 introduced in 2017. Attackers with a local low-privileged account can exploit this flaw via AF_ALG, splice, and the authencesn decryption path to trigger controlled writes to the page cache of files. This enables them to tamper with read-only files or the in-memory cache content of SUID programs, ultimately leading to local privilege escalation.
This vulnerability cannot be exploited remotely on its own, but it poses a higher risk in shared hosting, CI runner, container, or multi-tenant environments. The official fix is to revert the unnecessary in-place operation logic in algif_aead and instead directly copy the associated data.
Affected Versions
The following Linux kernel versions are affected:
- Ubuntu 24.04 (LTS, 6.17.0-1007-aws and earlier)
- Amazon Linux 2023 (6.18.8-9.213.amzn2023 and earlier)
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux 8
- SUSE 16 (6.12.0-160000.9-default and earlier)
- Debian/Arch/Fedora/Rocky/Alma/Oracle and other distributions with kernel versions from the same period
- Affected kernel commit range: commit 72548b093ee3 ≤ version < commit a664bf3d603d
Remediation Solutions
Official Solutions
The latest versions have been officially released to fix the vulnerability. Affected users are advised to update the Linux kernel to one of the latest versions as needed.
Download link: https://git.kernel.org/stable/c/a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5
Temporary Solutions
- Disable unused functional modules to reduce attack entry points.
- Follow the principle of least privilege to strictly control the scope of permissions for sensitive operations.
- Do not expose services to the Internet unless necessary, to limit the access sources to trusted ranges.
- Regularly update the system and components to secure versions so that known vulnerabilities can be patched at the earliest opportunity.
Timeline
On April 30, 2026, Sangfor FarSight Labs received notification of the local privilege escalation vulnerability in the Linux kernel (CVE-2026-31431).
On April 30, 2026, Sangfor FarSight Labs released a vulnerability alert.
Reference
https://www.openwall.com/lists/oss-security/2026/04/29/23
Learn More
Sangfor FarSight Labs researches the latest cyber threats and unknown zero-day vulnerabilities, alerting customers to potential dangers to their organizations, and providing real-time solutions with actionable intelligence. Sangfor FarSight Labs works with other security vendors and the security community at large to identify and verify global cyber threats, providing fast and easy protection for customers.
