# Copy Fail and DirtyFrag: Linux Page Cache Bugs in the Wild

Logic bug in Linux authencesn template lets AF_ALG+splice() write 4 bytes into page cache of setuid binaries, escalating to root.

- Payout: Real-world hack
- Severity: high
- Program: Linux kernel
- Analysis by: Ruben Groenewoud, Eric Forte, Samir Bousseaden
- Disclosed: 2026-05-09
- CVE: CVE-2026-31431
- Write-up quality: 7/10
- Original: https://www.elastic.co/security-labs/threat-command/copy-fail-dirtyfrag-linux-page-bugs-in-the-wild
- Library page: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-copy-fail-dirtyfrag-linux-page-bugs-in-the-wild
- Tags: area:oss domain:oss impact:integrity impact:privesc kind:incident platform:threat-intel sev:high tech:linux technique:chained vuln:memory-corruption vuln:privilege-escalation

**Target:** Linux kernel authencesn crypto template via AF_ALG/splice
**Root cause:** Logic bug in the authencesn cryptographic template allows in-place crypto operations on spliced read-only file pages, producing a controlled 4-byte write into the page cache.
**Steps:**
1. Open a socket(AF_ALG) to access the kernel crypto subsystem.
2. Use splice() to inject read-only file pages (e.g. /usr/bin/su) into network buffers.
3. Trigger in-place crypto via authencesn to perform a controlled 4-byte write into the page cache.
4. Corrupt the in-memory view of the setuid binary and execute it to gain root, without modifying the file on disk.
**Exploitation:** A 732-byte Python script chains AF_ALG and splice() to corrupt the page cache of /usr/bin/su, then executes it to escalate to root; works across Ubuntu, Amazon Linux, RHEL, and SUSE.
**Escalation:** Corrupting a setuid binary's in-memory image yields effective uid 0 from a non-root caller.
**Insight:** In-place crypto templates operating on spliced pages can write into page cache of read-only files; audit AF_ALG AEAD paths and splice() from non-root processes as an exploitation primitive.

## Write-ups of the same bug (oldest first)
- 2026-05-01: [Copy Fail: Universal Linux Local Privilege Escalation Vulnerability](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-copyfail-cve-2026-31431-linux-privilege-escalation-vulnerability) — Wiz Research
- 2026-05-09: [Copy Fail and DirtyFrag: Linux Page Cache Bugs in the Wild](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-copy-fail-dirtyfrag-linux-page-bugs-in-the-wild) — Ruben Groenewoud, Eric Forte, Samir Bousseaden (this one)
- 2026-05-28: [From Exploit Code to Production Detection: Building a CVE-2026-31431 (Copy Fail) detection with Agents](https://bugbountylibrary.com/r/blog%3Asecuritylabs-datadoghq-com-articles-cve-2026-31431-copy-fail-exploit-detection-with-agents) — Datadog Security Labs