Change Details

Several Linux distributions are since about year 2017 affected by Local Linux kernel privilege escalation vulnerability (CVE-2026-31431) named https://copy.fail/ Classified as CVSS score 7.8 (high). It seems like at least VyOS 1.4.4 is affected (and 1.5, rolling and stream until new releases are out). Description: Copy Fail: 732 Bytes to Root on Every Major Linux Distributions Xint Code disclosed CVE-2026-31431, an authencesn scratch-write bug chaining AF_ALG + splice() into a 4-byte page cache write. A 732-byte PoC gets root on Ubuntu, Amazon Linux, RHEL, SUSE. Possible mitigations: Add any of these as kernel boot flag (grub): Blacklist affected functions: ``` initcall_blacklist=algif_aead_init ``` Blacklist just the af_alg interface itself: ``` initcall_blacklist=af_alg_init ``` Blacklist just the affected algorithm: ``` initcall_blacklist=crypto_authenc_esn_module_init ``` References: https://security-tracker.debian.org/tracker/CVE-2026-31431 https://access.redhat.com/security/cve/cve-2026-31431 https://xint.io/blog/copy-fail-linux-distributions

Several Linux distributions are since about year 2017 affected by Local Linux kernel privilege escalation vulnerability (CVE-2026-31431) named https://copy.fail/ Classified as CVSS score 7.8 (high). It seems like at least VyOS 1.4.4 is affected (and 1.5, rolling and stream until new releases are out). Description: Copy Fail: 732 Bytes to Root on Every Major Linux Distributions Xint Code disclosed CVE-2026-31431, an authencesn scratch-write bug chaining AF_ALG + splice() into a 4-byte page cache write. A 732-byte PoC gets root on Ubuntu, Amazon Linux, RHEL, SUSE. Possible mitigations: Add any of these as kernel boot flag (grub): Blacklist affected functions: ``` initcall_blacklist=algif_aead_init ``` Blacklist just the af_alg interface itself: ``` initcall_blacklist=af_alg_init ``` Blacklist just the affected algorithm: ``` initcall_blacklist=crypto_authenc_esn_module_init ``` References: https://www.cvedetails.com/cve/CVE-2026-31431/ https://security-tracker.debian.org/tracker/CVE-2026-31431 https://access.redhat.com/security/cve/cve-2026-31431 https://xint.io/blog/copy-fail-linux-distributions

Several Linux distributions are since about year 2017 affected by Local Linux kernel privilege escalation vulnerability (CVE-2026-31431) named https://copy.fail/ Classified as CVSS score 7.8 (high). It seems like at least VyOS 1.4.4 is affected (and 1.5, rolling and stream until new releases are out). Description: Copy Fail: 732 Bytes to Root on Every Major Linux Distributions Xint Code disclosed CVE-2026-31431, an authencesn scratch-write bug chaining AF_ALG + splice() into a 4-byte page cache write. A 732-byte PoC gets root on Ubuntu, Amazon Linux, RHEL, SUSE. Possible mitigations: Add any of these as kernel boot flag (grub): Blacklist affected functions: ``` initcall_blacklist=algif_aead_init ``` Blacklist just the af_alg interface itself: ``` initcall_blacklist=af_alg_init ``` Blacklist just the affected algorithm: ``` initcall_blacklist=crypto_authenc_esn_module_init ``` References: https://www.cvedetails.com/cve/CVE-2026-31431/ https://security-tracker.debian.org/tracker/CVE-2026-31431 https://access.redhat.com/security/cve/cve-2026-31431 https://xint.io/blog/copy-fail-linux-distributions