# Copy Fail: Universal Linux Local Privilege Escalation Vulnerability

Logic flaw in Linux algif_aead scatter-gather handling lets unprivileged users write 4 controlled bytes into page cache of any readable file, enabling root via setuid binary corruption.

- Payout: Research
- Severity: high
- Program: Linux kernel
- Credited: Wiz Research
- Disclosed: 2026-05-01
- CVE: CVE-2026-31431
- Write-up quality: 7/10
- Original: https://www.wiz.io/blog/copyfail-cve-2026-31431-linux-privilege-escalation-vulnerability
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-copyfail-cve-2026-31431-linux-privilege-escalation-vulnerability
- Tags: domain:desktop impact:internal-access impact:privesc kind:research platform:threat-intel sev:high tech:linux technique:chained vuln:memory-corruption vuln:privilege-escalation

**Target:** Linux kernel AEAD crypto implementation (algif_aead) via AF_ALG sockets and splice()
**Root cause:** Improper handling of scatter-gather lists in the AEAD crypto implementation allows a write beyond intended bounds, letting an attacker write 4 controlled bytes into the page cache of any readable file.
**Steps:**
1. Open an AF_ALG socket for the AEAD algorithm.
2. Craft scatter-gather input via splice() to trigger the out-of-bounds write.
3. Target a readable setuid binary such as `/usr/bin/su` to overwrite 4 bytes in its page cache.
4. Execute the corrupted binary to gain root.
**Exploitation:** Attacker with an unprivileged local account uses AF_ALG sockets plus splice() to write 4 controlled bytes into the page cache of a setuid binary like /usr/bin/su, modifying it in memory without touching disk, then executes it to obtain root. Container escape possible when an unprivileged container shares a base image with a privileged container on the same node.
**Escalation:** Chained with container escape: overwrite binaries in a shared base image layer to pivot from unprivileged container to host via a privileged container on the same node.
**Insight:** Page-cache writes bypass disk integrity checks entirely, so setuid binaries are prime targets; look for kernel crypto/socket interfaces (AF_ALG) that accept user-controlled scatter-gather lists where bounds handling can be abused.