Linux Kernel Security Vulnerability Advisory

A Local Privilege Escalation (LPE) vulnerability, CVE-2026-31431 (Copy Fail), has been found affecting most mainstream Linux distributions built between 2017 and the recent patch.

This vulnerability allows an unprivileged local user to gain root privileges, and it is particularly high-risk in the following environments:

• Kubernetes and container clusters: By exploiting page cache sharing characteristics, attackers can cross container boundaries to access host nodes and other tenants' data.
• CI/CD runners: In environments running untrusted code such as GitHub Actions and GitLab Runner, root privilege takeover is possible.
• Cloud SaaS and AI notebooks: Host privileges can be seized in sandboxes, agent environments, and serverless functions that execute user code.
• Multi-tenant hosts: Development servers or shell services shared by multiple users.

Mitigation

1. Kernel patch (recommended): Update your distribution's kernel package to the latest version to use a kernel where this vulnerability has been fixed.
2. Temporary mitigation: Until the patch is applied, disable the algif_aead module. echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf rmmod algif_aead

On most systems, disabling this module does not affect major cryptographic functions such as SSH, dm-crypt, and kTLS.