CVE-2026-31431

crypto: algif_aead - Revert to operating out-of-place

In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.

Affected

Linux

CVSS v3.1 CNA

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

3.44% chance of exploitation in the next 30 days, 89th percentile

CISA KEV

added 2026-05-01

Nuclei

high · CWE-787

Published

2026-04-22

Updated

2026-10-15

Proof-of-concept exploits (236)

• John-Popovici/CVE-2026-31431-CopyFail-Linux-PrivEsc0★ · 2026-06-08
• theori-io/copy-fail-CVE-2026-314314081★ · 2026-04-29
• rootsecdev/cve_2026_31431575★ · 2026-04-29
• Sndav/CVE-2026-31431-Advanced-Exploit112★ · 2026-04-30
• 0xShe/CVE-2026-3143145★ · 2026-04-30
• Percivalll/Copy-Fail-CVE-2026-31431-Kubernetes-PoC191★ · 2026-05-07
• painoob/Copy-Fail-Exploit-CVE-2026-31431109★ · 2026-04-29
• iss4cf0ng/CVE-2026-31431-Linux-Copy-Fail56★ · 2026-04-30
• tgies/copy-fail-c447★ · 2026-07-17
• shadowabi/CVE-2026-31431-CopyFail-Universal-LPE59★ · 2026-05-06
• Crihexe/copy-fail-tiny-elf-CVE-2026-3143164★ · 2026-05-03
• ZephrFish/CopyFail-CVE-2026-3143130★ · 2026-07-30
• JuanBindez/CVE-2026-3143129★ · 2026-06-05
• qi4L/CVE-2026-31431-Container-Escape27★ · 2026-05-02
• SeanRickerd/cve-2026-3143112★ · 2026-05-01
• sgkdev/page_inject77★ · 2026-05-06
• AliHzSec/CVE-2026-314317★ · 2026-05-01
• b5null/CVE-2026-31431-C6★ · 2026-04-30
• Smarttfoxx/copyfail20★ · 2026-05-12
• yuspring/cve-2026-31431-poc3★ · 2026-05-01
• M4xSec/CVE-2026-31431-RCE-Exploit7★ · 2026-05-02
• sammwyy/copyfail-rs15★ · 2026-04-30
• 0xBlackash/CVE-2026-314312★ · 2026-04-30
• xeloxa/copyfail-exploit34★ · 2026-05-05
• luotian2/CVE-2026-314312★ · 2026-04-30
• malwarekid/CVE-2026-314319★ · 2026-05-02
• desultory/CVE-2026-314317★ · 2026-04-30
• cs8425/copy-fail-go2★ · 2026-04-30
• ErdemOzgen/copy-fail-cve-2026-314318★ · 2026-05-01
• MartinPham/copy-fail-CVE-2026-31431-php9★ · 2026-05-02
• wesmar/CVE-2026-314316★ · 2026-04-30
• Juguitos/copy-fail3★ · 2026-05-09
• Shotafry/CopyFail-Exploits-CVE-2026-314317★ · 2026-05-01
• wuwu001/CVE-2026-31431-exploit4★ · 2026-04-30
• Xerxes-2/CVE-2026-31431-rs4★ · 2026-05-01
• ben-slates/CVE-2026-31431-Exploit5★ · 2026-05-01
• Sl4cK0TH/CVE-2026-31431-PoC4★ · 2026-05-02
• KanbaraAkihito/CVE-2026-31431-copyfail-rs3★ · 2026-05-06
• AdityaBhatt3010/CVE-2026-314313★ · 2026-05-06
• guiimoraes/CVE-2026-314313★ · 2026-05-08
• rvzsec/CVE-2026-314314★ · 2026-05-08
• povzayd/CVE-2026-314313★ · 2026-05-01
• hans362/CVE-2026-31431-Copy-Fail-Container-Escape0★ · 2026-05-07
• novysodope/copy-fail-CVE-2026-31431-C4★ · 2026-04-30
• bigwario/copy-fail-CVE-2026-31431-C4★ · 2026-05-06
• lonelyor/CVE-2026-31431-exp3★ · 2026-05-11
• beatbeast007/Linux-CopyFail-C-Version-CVE-2026-314314★ · 2026-05-01
• g1nt0n1x/copy-fail-CVE-2026-31431-shell3★ · 2026-05-04
• Dullpurple-sloop726/CVE-2026-31431-Linux-Copy-Fail3★ · 2026-10-09
• EynaExp/Copy-Fail-CVE-2026-31431-modernized3★ · 2026-05-02
• TheMalwareGuardian/CVE-2026-314312★ · 2026-05-05
• Alfredooe/CVE-2026-314312★ · 2026-04-29
• ExploitEoom/CVE-2026-314312★ · 2026-05-01
• pascal-gujer/CVE-2026-314312★ · 2026-04-30
• nisec-eric/cve-2026-314312★ · 2026-05-01
• pedromizz/copy-fail2★ · 2026-05-02
• gagaltotal/cve-2026-31431-copy-fail2★ · 2026-05-07
• Percivalll/Copy-Fail-CVE-2026-31431-Statically-PoC3★ · 2026-04-30
• JnamerZ/CopyFail-CVE-2026-314312★ · 2026-04-30
• sec17br/CVE-2026-31431-Copy-Fail2★ · 2026-04-30
• scriptzteam/Paranoid-Copy-Fail-CVE-2026-314312★ · 2026-04-30
• kvakirsanov/CVE-2026-31431-live-process-code-injection2★ · 2026-05-01
• xn0kkx/CVE-2026-31431_CopyFail_LinuxKernel_LPE2★ · 2026-05-04
• abdullaabdullazade/CVE-2026-314312★ · 2026-04-30
• H1d3r/copy-fail_LPE_Interactive0★ · 2026-04-30
• yxdm02/CVE-2026-314311★ · 2026-04-30
• yiyihuohuo/CVE-2026-314311★ · 2026-04-30
• st4rburn/RootRemover4★ · 2026-05-17
• 6abc/Copy-Fail-CVE-2026-31431-dirty-frag-CVE-2026-432841★ · 2026-08-13
• abhishekhargan/CVE-2026-314310★ · 2026-05-01
• ruattd/cve-2026-314310★ · 2026-04-30
• leelong2020/cve-2026-314310★ · 2026-05-01
• 0xN7y/CVE-2026-314310★ · 2026-05-06
• G01d3nW01f/CVE-2026-314310★ · 2026-04-30
• mCub3/CVE-2026-314310★ · 2026-05-03
• TheMursalin/CVE-2026-314310★ · 2026-05-02
• ashok523/cve-2026-314310★ · 2026-05-02
• pvpaulo01/cve-2026-314310★ · 2026-05-07
• devtint/CVE-2026-314310★ · 2026-05-05
• Gr-1m/CVE-2026-314311★ · 2026-05-02
• dorianhhuc/CVE-2026-314310★ · 2026-04-30
• ryan2929/CVE-2026-314310★ · 2026-05-28
• suominen/CVE-2026-314310★ · 2026-08-01
• FrosterDL/CVE-2026-314310★ · 2026-05-01
• twowb/CVE-2026-31431-0★ · 2026-04-30
• pulentoski/CVE-2026-314311★ · 2026-05-03
• MetaspIoit/CVE-2026-314310★ · 2026-05-04
• offsecguy/CVE-2026-314310★ · 2026-05-01
• HulnotHutu/CVE-2026-314310★ · 2026-05-16
• vyahello/CVE-2026-314310★ · 2026-05-03
• websecnl/CVE-2026-314310★ · 2026-04-30
• tfawnies/CVE-2026-314310★ · 2026-05-03
• Lutfifakee-Project/CVE-2026-314311★ · 2026-09-27
• gbonacini/CVE-2026-314311★ · 2026-05-19
• StarxSky/CVE-2026-314310★ · 2026-05-06
• kaleth4/CVE-2026-314310★ · 2026-05-03
• studiogangster/CVE-2026-314311★ · 2026-05-12
• mishl-dev/CVE_2026_314311★ · 2026-04-30
• Naimadx123/cve_2026_314311★ · 2026-04-29
• Mrhudson69/cve-2026-314310★ · 2026-05-08
• mirr81/cve-2026_314310★ · 2026-05-04
• KhaosFarbauti/CVE-2026-314310★ · 2026-05-05
• 361way/CVE-2026-314310★ · 2026-05-07
• moaaz-mostafa123/CVE-2026-314310★ · 2026-05-02
• Sebastian294/cve-2026-314311★ · 2026-05-15
• xd20111/CVE-2026-314310★ · 2026-05-02
• freelabz/CVE-2026-314310★ · 2026-04-30
• mfloresdacunha/CVE-2026-314311★ · 2026-05-04
• zhanghangorg/cve-2026-314310★ · 2026-05-05
• AdemZero/CVE-2026-314310★ · 2026-05-10
• vishwanathakuthota/copy-fail-CVE-2026-314310★ · 2026-04-30
• SilverRuler/copy-fail-CVE-2026-314310★ · 2026-09-03
• polyakovavv/copyfail0★ · 2026-05-11
• poyea/CVE-2026-31431.c1★ · 2026-05-01
• eleveni386/CVE-2026-31431-Golang0★ · 2026-04-30
• DENNISDGR/CVE-2026-31431-poc1★ · 2026-04-30
• galoryber/CVE-2026-31431-cleaned1★ · 2026-04-30
• gmeghnag/TEST-CVE-2026-314310★ · 2026-04-30
• alvaroguzmancode/CVE-2026-31431-mitigacion1★ · 2026-05-04
• cxwx/cpp-CVE-2026-314310★ · 2026-05-02
• Trex1e/copyfail-CVE-2026-314311★ · 2026-05-02
• darioomatos/cve-2026-31431-copyfail1★ · 2026-05-06
• weirdindiankid/copy-fail0★ · 2026-04-30
• Industri4l-H3ll-Xpl0it3rs/CVE-2026-31431-Copy-Fail0★ · 2026-05-05
• glask1d/CVE-2026-31431-PoC0★ · 2026-05-01
• Morton-Li/copy-fail-CVE-2026-314310★ · 2026-05-10
• w3llr00t3d/CVE-2026-31431-PoC0★ · 2026-04-30
• astounds/copy-fail-CVE-2026-314310★ · 2026-05-03
• reubensammut/CVE-2026-31431-Copy-Fail0★ · 2026-05-06
• wuzuowei/copy-fail-CVE-2026-314310★ · 2026-04-30
• jneuhauser/copy-fail-CVE-2026-314310★ · 2026-04-29
• ozergoker/CVE-2026-31431-copy-fail0★ · 2026-05-05
• rio128128/copy-fail-CVE-2026-314310★ · 2026-04-30
• Fulucky0-yuri/CVE-2026-31431-PocC1★ · 2026-05-01
• dgrobinson0/CopyFile_CVE-2026-314311★ · 2026-05-11
• grishinpv/CVE-2026-31431-old-python0★ · 2026-04-30
• bedros-p/kopy-fail-CVE-2026-314310★ · 2026-05-01
• pyroceper/copy-fail-CVE-2026-314313★ · 2026-05-03
• MrMixies/Copy-Fail---CVE-2026-314310★ · 2026-05-05
• ravindercodes/copy-fail-CVE-2026-314310★ · 2026-05-04
• B1gN0Se/copy-fail-CVE-2026-314310★ · 2026-04-30
• mmionf/copy-fail-CVE-2026-314310★ · 2026-05-02
• effiesec/copy-fail-cve-2026-314310★ · 2026-04-30
• 0xFuffM3/CVE-2026-31431-CopyFail0★ · 2026-05-14
• hori0729/CVE-2026-31431-Verificador-Exploit0★ · 2026-05-08
• MohamedKarrab/Copy-Fail-CVE-2026-314310★ · 2026-04-30
• RecoFu/CVE-2026-31431-Copy-Fail0★ · 2026-05-01
• ROSNLR5/modrosnlr50★ · 2026-05-08
• Spoo1k/Copy-Fail-Exploit-CVE-2026-314310★ · 2026-05-01
• adilkurtulmus/linux-copy-fail-CVE-2026-314310★ · 2026-05-11
• ikow/CVE-2026-31431-live-code-corruption0★ · 2026-05-08
• euriconicacio/copy-fail-CVE-2026-31431-poc1★ · 2026-05-02
• julichaan/CVE-2026-31431-python-copyfail-POC0★ · 2026-05-07
• sh4den/CVE-2026-31431-copyfail-aarch640★ · 2026-06-23
• Y5neKO/copy-fail-CVE-2026-31431-universal1★ · 2026-04-30
• Isw-9/copy-fail-cve-2026-31431-aarch640★ · 2026-04-30
• maniakh/CVE-2026-31431---Copy-Fail-PoC1★ · 2026-05-01
• imkk000/play-go-copy-fail-cve-2026-314310★ · 2026-05-05
• ChernStepanov/CopyFail-for-dummies1★ · 2026-05-03
• jiangban046-spec/CVE-2026-31431-exploit_py2_py30★ · 2026-04-30
• OneDemobird/copy-fail-CVE-2026-31431-pythonlower3.101★ · 2026-05-06
• Rat5ak/CVE-2026-31431-CopyFail-static-ELF--POC0★ · 2026-05-05
• 0xer0/CVE-2026-31431-Copy-Fail-add-arm642★ · 2026-05-07
• Mr-bv/Copy-fail-CVE-2026-31431-Exploit-in-C0★ · 2026-05-08
• Callum-Cameron26/CVE_2026_31431-Testing-the-Copy-Fail-exploit0★ · 2026-07-12
• luoqianlin/copyfail-c0★ · 2026-05-09
• YuCc777/Copy-Fail-CVE-2026-31431-Linux-exp-tools-C-EXP0★ · 2026-05-03
• Hunt-Benito/copy-fail-cve-2026-31431-linux-kernel-page-cache-lpe0★ · 2026-06-21
• Lyutoon/CopyFail-Experiment1★ · 2026-05-01
• iblamenear/CVE-2026-31431-Copy-Fail---Advanced-LPE-Proof-of-Concept---C-Rewrite0★ · 2026-05-06
• monobrau/copyfailscan0★ · 2026-06-11
• dotPY-hax/CopyFail0★ · 2026-05-14
• 3jee/copy-fail-go2★ · 2026-05-01
• cleozi/Copy_Grail0★ · 2026-05-10
• kwilck/copyfail1★ · 2026-05-07
• sgkdev/ptrace_may_dream21★ · 2026-05-20
• Iamliuxiaozhen/copy_fail2★ · 2026-05-26
• kinryulabs/rootpacket-cve-2026-314312★ · 2026-06-24
• 1neptune/CopyFail2★ · 2026-06-03
• royayub/CVE-2026-314310★ · 2026-05-18
• SugiB3o/CVE-2026-314310★ · 2026-06-27
• songzzzz/CVE-2026-314310★ · 2026-05-28
• yangh-beep/CVE-2026-31431-C0★ · 2026-05-21
• zs1n/copy-fail-CVE-2026-314310★ · 2026-06-05
• tematemaru/CVE-2026-31431-simple-test1★ · 2026-07-16
• t1ckprivate/CVE-2026-31431-Copy-Fail0★ · 2026-06-05
• JimmyPughtron/CVE-2026-31431-Copy-Fail---Minified-LPE-PoC0★ · 2026-05-21
• jihwan77/Linux-Kernel-Copy-Fail-CVE-2026-31431-0★ · 2026-07-06
• nonameuserosint-hue/Copyfail-sh0★ · 2026-05-14
• Maxime288/CVE-2026-31431-Copy-Fail-R-pertoire-de-Pr-vention0★ · 2026-05-18
• 4n4s4zi/copyfail-alpine2★ · 2026-06-04
• TrevoCastles/CVE-2026-31431-copy-fail2★ · 2026-08-02
• TeamN4C/SG-2026-00130★ · 2026-07-31
• dev1681/CVE-2026-314310★ · 2026-08-04
• govind-sec/linux-copy-fail-exploit1★ · 2026-05-02
• rodkodanila/copy.fail.ocp-poc0★ · 2026-05-06
• Kalyani4114/linux-copy-fail-exploit0★ · 2026-05-03
• aegeiger/openshell-sandbox-poc2★ · 2026-06-18
• mostafatamime99/Linux-privesc-PoC1★ · 2026-07-07
• Vehicle-Security/PoCLab0★ · 2026-06-18
• songzzzz/dirtyfrag1★ · 2026-06-02
• nek-3231/copyfail-poc0★ · 2026-08-28
• RBKD-SEC/POC0★ · 2026-08-31
• adityasingh108/CVE-2026-31431-Metasploit-exploit2★ · 2026-05-17
• danimrtzp/CVE-2026-31431-REVSHELL0★ · 2026-05-03
• liamromanis101/CVE-2026-31431-Copy-Fail---Vulnerability-Detection-Script26★ · 2026-05-06
• mauricioportela/CVE-2026-31431-Analysis0★ · 2026-06-10
• rippsec/CVE-2026-31431-Copy-Fail1★ · 2026-05-05
• sibersan/cve-2026-31431-checker0★ · 2026-05-03
• 2H-K/LinuxKernelVULRecurrence0★ · 2026-06-13
• Arialejo01/Copy-Fail0★ · 2026-05-21
• Aryma-f4/solid-sniffle0★ · 2026-04-30
• HYCQAQ/Logitech-G-Cloud-GhostLock-CVE-2026-434995★ · 2026-07-15
• Nu1i/exploit_cve_2026_31431_py360★ · 2026-05-01
• Starwarsfan2099/Copy-Fail-C0★ · 2026-04-30
• UnHackerEnCapital/ModoHefinsito16★ · 2026-05-15
• ZocketZero/vuln0★ · 2026-06-17
• alanh0vx/copy-fail-demo-docker0★ · 2026-05-04
• bane-stealthium/copy_fail_minimal1★ · 2026-05-01
• ercihan/copy.fail9★ · 2026-05-12
• hackingyseguridad/root3★ · 2026-07-17
• kaviev/transferfiles0★ · 2026-07-20
• krislamo/vulnlab0★ · 2026-05-22
• launchscroll/copy-fail-compiled0★ · 2026-05-08
• nisec-eric/dirty-frag0★ · 2026-05-10
• notchxor/copy-fail1★ · 2026-05-01
• paktiko1986/CopyFail20260★ · 2026-07-14
• raesene/vuln_pocs5★ · 2026-09-24
• FranklinF25/cve-2026-314310★ · 2026-09-04
• starscow/Copy-Fail-CVE-2026-31431-Kubernetes-PoC0★ · 2026-04-30
• Minime794/copyfail0★ · 2026-09-18
• clementnuss/copyfail-cve-exploits1★ · 2026-09-24
• CybroZeus/Copy-Fail-Exploit-CVE-2026-314310★ · 2026-05-02
• rifkyards/Copy-Fail-CVE-2026-31431-Kubernetes-PoC0★ · 2026-05-07
• 1amBa7Man/Linux-copy-fail-CVE-2026-31431/blob/4186341af92164c2e5ce922c7d36cee74607e892/ex…1★ · 2026-05-06
• 4xura/CVE-2026-31431-Copy-Fail/blob/9b2a920ee1a5c4590df88c8cb423daec35a04d51/exploit-scri…8★ · 2026-05-19

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/code/cves/2026/CVE-2026-31431.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/cve_2026_31431_copy_…

Security advisories

• https://lore.kernel.org/linux-cve-announce/2026042214-CVE-2026-31431-3d65@gregkh
• https://access.redhat.com/errata/RHSA-2026:13565
• https://access.redhat.com/errata/RHSA-2026:13566
• https://access.redhat.com/errata/RHSA-2026:13577
• https://access.redhat.com/errata/RHSA-2026:13578
• https://access.redhat.com/errata/RHSA-2026:13681
• https://access.redhat.com/errata/RHSA-2026:13690
• https://access.redhat.com/errata/RHSA-2026:13727
• https://access.redhat.com/errata/RHSA-2026:13729
• https://access.redhat.com/errata/RHSA-2026:13734
• https://access.redhat.com/errata/RHSA-2026:13811
• https://access.redhat.com/errata/RHSA-2026:13862
• https://access.redhat.com/errata/RHSA-2026:13885
• https://access.redhat.com/errata/RHSA-2026:13887
• https://access.redhat.com/errata/RHSA-2026:13932
• https://access.redhat.com/errata/RHSA-2026:13936
• https://access.redhat.com/errata/RHSA-2026:14097
• https://access.redhat.com/errata/RHSA-2026:14112
• https://access.redhat.com/errata/RHSA-2026:14137
• https://access.redhat.com/errata/RHSA-2026:14165
• https://access.redhat.com/errata/RHSA-2026:14230
• https://access.redhat.com/errata/RHSA-2026:14301
• https://access.redhat.com/errata/RHSA-2026:14339
• https://access.redhat.com/errata/RHSA-2026:14773
• https://access.redhat.com/errata/RHSA-2026:14926
• https://access.redhat.com/errata/RHSA-2026:15087
• https://access.redhat.com/errata/RHSA-2026:15976
• https://access.redhat.com/errata/RHSA-2026:15978
• https://access.redhat.com/errata/RHSA-2026:16018
• https://access.redhat.com/errata/RHSA-2026:16063
• https://access.redhat.com/errata/RHSA-2026:16111
• https://access.redhat.com/errata/RHSA-2026:16208
• https://access.redhat.com/errata/RHSA-2026:16209
• https://access.redhat.com/errata/RHSA-2026:16210
• https://access.redhat.com/errata/RHSA-2026:19074
• https://access.redhat.com/errata/RHSA-2026:19225
• https://access.redhat.com/errata/RHSA-2026:33486
• https://access.redhat.com/security/cve/CVE-2026-31431
• https://access.redhat.com/security/cve/cve-2026-31431#cve-details-mitigation
• https://bugzilla.redhat.com/show_bug.cgi?id=2460538
• https://cert-portal.siemens.com/productcert/html/ssa-019113.html
• https://cert-portal.siemens.com/productcert/html/ssa-082556.html
• https://cert-portal.siemens.com/productcert/html/ssa-265688.html
• https://cert-portal.siemens.com/productcert/html/ssa-328642.html
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31431.json
• https://websec.net/blog/cve-2026-31431-linux-algifaead-page-cache-write-to-root-69f38a4cc…
• https://www.kb.cert.org/vuls/id/260001
• https://xint.io/blog/copy-fail-linux-distributions#the-fix-6
• http://www.openwall.com/lists/oss-security/2026/04/29/23
• http://www.openwall.com/lists/oss-security/2026/04/29/25
• http://www.openwall.com/lists/oss-security/2026/04/29/26
• http://www.openwall.com/lists/oss-security/2026/04/30/10
• http://www.openwall.com/lists/oss-security/2026/04/30/11
• http://www.openwall.com/lists/oss-security/2026/04/30/12
• http://www.openwall.com/lists/oss-security/2026/04/30/14
• http://www.openwall.com/lists/oss-security/2026/04/30/15
• http://www.openwall.com/lists/oss-security/2026/04/30/16
• http://www.openwall.com/lists/oss-security/2026/04/30/5
• https://git.kernel.org/stable/c/19d43105a97be0810edbda875f2cd03f30dc130c
• https://git.kernel.org/stable/c/3115af9644c342b356f3f07a4dd1c8905cd9a6fc
• https://git.kernel.org/stable/c/893d22e0135fa394db81df88697fba6032747667
• https://git.kernel.org/stable/c/8b88d99341f139e23bdeb1027a2a3ae10d341d82
• https://git.kernel.org/stable/c/961cfa271a918ad4ae452420e7c303149002875b
• https://git.kernel.org/stable/c/a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5
• https://git.kernel.org/stable/c/ce42ee423e58dffa5ec03524054c9d8bfd4f6237
• https://git.kernel.org/stable/c/fafe0fa2995a0f7073c1c358d7d3145bcc9aedd8

References

• CVE Record
• NVD entry

Related

• CVE-2016-0189
• CVE-2016-7200
• CVE-2016-7201
• CVE-2022-26717
• CVE-2022-32250
• CVE-2026-43284