13 votes

Linux priveledge escalation (CVE-2026-31431)

6 comments

  1. lynxy
    Link
    The kernel mailing list entry can be found here.

    If your kernel was built between 2017 and the patch — which covers essentially every mainstream Linux distribution — you're in scope.

    Copy Fail requires only an unprivileged local user account — no network access, no kernel debugging features, no pre-installed primitives. The kernel crypto API (AF_ALG) ships enabled in essentially every mainstream distro's default config, so the entire 2017 → patch window is in play out of the box.

    The kernel mailing list entry can be found here.

    4 votes
  2. [4]
    pete_the_paper_boat
    Link
    The en dash per sentence ratio is off the charts

    The en dash per sentence ratio is off the charts

    2 votes
    1. [3]
      lynxy
      Link Parent
      Yeah, unfortunately I think the whole page is AI generated (or at least edited by AI), but this seems to be a legit issue with an actual CVE and the page provides information on what devices are...

      Yeah, unfortunately I think the whole page is AI generated (or at least edited by AI), but this seems to be a legit issue with an actual CVE and the page provides information on what devices are most at risk.

      1. [2]
        arqalite
        Link Parent
        Seems like the vulnerability was also found by AI, or at least partly helped by it (as Xint Code seems to be mostly a swarm of AI agents doing code scanning).

        Seems like the vulnerability was also found by AI, or at least partly helped by it (as Xint Code seems to be mostly a swarm of AI agents doing code scanning).

        1. fxgn
          Link Parent
          From the FAQ:

          From the FAQ:

          Was this AI-found?

          AI-assisted. The starting insight — that splice() hands page-cache pages into the crypto subsystem and that scatterlist page provenance might be an under-explored bug class — came from human research by Taeyang Lee at Xint.

          From there, Xint Code scaled the audit across the entire crypto/ subsystem in roughly an hour. Copy Fail was the highest-severity finding in the run.

  3. vord
    Link
    I want to do more sleuthing, because I recall Linus getting quite mad at security bros around that time trying to push what he deemed unnecessary complexity into the kernel for little benefit. An...

    I want to do more sleuthing, because I recall Linus getting quite mad at security bros around that time trying to push what he deemed unnecessary complexity into the kernel for little benefit.

    An older email advocating for keeping it disabled. (not Linus, but interesting)

    Using AF_ALG introduces a new set on unexpected syscalls (network related syscalls, for a utility that ostensiblty does not touch the network).
    Normally this is not a problem, but under some systemd or containers setup this could lead to unexpected problems.