# In-place decrypt of spliced page-cache pages

Kernel crypto or socket paths that decrypt in place into splice-fed file-backed pages, corrupting page cache

_Area: Memory corruption and native code. Seen in 2 disclosed reports; latest 2026-05-28. Updated 2026-10-23._

## How it works

A kernel path is handed a buffer that `splice()` backed with the page-cache pages of a file the attacker can only read. The path then treats that buffer as scratch space: an AEAD decrypt writes plaintext (or keystream-derived bytes) back into its input, or an skb coalescing step decrypts file-backed fragments in place. The assumption that breaks is that a read-only file reference is not a write reference. No VFS write occurs, so permissions, file mode and on-disk integrity are never consulted, yet the cached contents of the file change for every process that later maps or executes it.

## Where it shows up

- Kernel crypto interfaces (AF_ALG, `algif_aead`) accepting user scatter-gather lists or splice-fed buffers for decrypt.
- AEAD modes whose decrypt writes into the input buffer rather than a separate output.
- Socket upper-layer protocols (e.g. ESP-in-TCP) that decrypt skb fragments in place after coalescing.
- Any path where file-backed pages enter a socket or crypto queue before the mode that will write to them is chosen.
- Fix commits that change fragment or scatter-gather handling.

## How to review

The invariant: a buffer backed by page-cache pages of a file opened read-only must never be written to by kernel crypto, socket, or coalescing code. Check whether the decrypt/writeback target is a private copy or the caller's input. Trace how the buffer was populated: if `splice()` from a file descriptor can reach it, require an explicit copy before any in-place operation, or reject file-backed pages outright. Confirm the write path cannot reach pages the caller lacks write permission on.

## Variants seen

- AEAD `authencesn` decrypt writing back into splice-backed input, patching setuid binaries [E1](https://bugbountylibrary.com/r/blog%3Asecuritylabs-datadoghq-com-articles-cve-2026-31431-copy-fail-exploit-detection-with-agents.md).
- `algif_aead` scatter-gather mishandling giving a small controlled write into any readable file's page cache [E3](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-copyfail-cve-2026-31431-linux-privilege-escalation-vulnerability.md).
- ESP-in-TCP decrypting spliced file-backed fragments in place after skb coalescing [E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-fragnesia-linux-kernel-local-privilege-escalation-via-esp-in-tcp.md).

## Why fixes fail

A patch for the earlier Dirty Frag bugs changed shared-fragment handling during skb coalescing and introduced the in-place decrypt primitive behind Fragnesia [E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-fragnesia-linux-kernel-local-privilege-escalation-via-esp-in-tcp.md). Fixes that adjust bounds or fragment handling without removing the in-place write into file-backed pages leave the root cause reachable.

## Impact and severity

Unprivileged local user to root: corrupted setuid binaries (`su`) execute attacker code [E1](https://bugbountylibrary.com/r/blog%3Asecuritylabs-datadoghq-com-articles-cve-2026-31431-copy-fail-exploit-detection-with-agents.md)[E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-fragnesia-linux-kernel-local-privilege-escalation-via-esp-in-tcp.md)[E3](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-copyfail-cve-2026-31431-linux-privilege-escalation-vulnerability.md). Page-cache-only corruption bypasses disk integrity checks and persists for all users until eviction, which raises severity and complicates detection.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Asecuritylabs-datadoghq-com-articles-cve-2026-31431-copy-fail-exploit-detection-with-agents.md
- E2: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-fragnesia-linux-kernel-local-privilege-escalation-via-esp-in-tcp.md
- E3: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-copyfail-cve-2026-31431-linux-privilege-escalation-vulnerability.md