0 TLDR

The name "Copy Fail" is almost ironic. The "copy" is not a normal copy into a private buffer; it is zero-copy splice() carrying a file-backed page reference into the crypto scatterlist path. The "fail" fails as a safety boundary: the AEAD decrypt may return an authentication error, but only after authencesn() has already corrupted the page cache.

This post is the full kill chain: page cache, pipes, splice(), AF_ALG, AEAD request construction, scatterlist walking, the authencesn() scratch write, and finally the PoC path from a 4-byte primitive to code execution. It is long by design. If you follow it end to end, Copy Fail stops being a mysterious one-liner exploit and becomes a clean kernel data-flow bug.

The writeup closes with multi-language exploit implementations tailored for different runtime environments in Chapter 7, for readers who want to jump straight to the final exploits.

Post navigator:

1 Preface

1.1 Copy Fail Overview

"Copy Fail" is the name given to CVE-2026-31431, a Linux kernel vulnerability that allows a low-priviledge user to instantly escalate to root, by overwriting the protected page-cache kernel memory which belongs to any read-only files.

The vulnerability exists in the interaction between:

• the Linux kernel crypto subsystem (AF_ALG),
• Linux zero-copy pipe mechanisms (splice()),
• and page-cache buffer handling.

Under the vulnerable scenario, the kernel mistakenly allows attacker-controlled data to be copied into file-backed cached pages, that should never become writable through unprivileged operations.

The conceptual attack flow looks like this:

    userspace                        kernel
════════════════════════════════════════════════════

 normal process
       │
       │ socket(AF_ALG) + splice()
       │
       ▼
┌───────────────────┐            ┌──────────────────────┐
│ vulnerable "copy" │───────────▶│ page cache corruption│
└───────────────────┘ unintended │ (readonly file page) │                   
                      write      └──────────┬───────────┘   
                                            │
                                            │ cached executable 
┌────────────────────┐                      │ code page modified
│ target SUID binary │ ◀────────────────────┘
└────────┬───────────┘             
         │
         │ executes modified code
         │
         ▼
        root

    userspace                        kernel
════════════════════════════════════════════════════

 normal process
       │
       │ socket(AF_ALG) + splice()
       │
       ▼
┌───────────────────┐            ┌──────────────────────┐
│ vulnerable "copy" │───────────▶│ page cache corruption│
└───────────────────┘ unintended │ (readonly file page) │                   
                      write      └──────────┬───────────┘   
                                            │
                                            │ cached executable 
┌────────────────────┐                      │ code page modified
│ target SUID binary │ ◀────────────────────┘
└────────┬───────────┘             
         │
         │ executes modified code
         │
         ▼
        root

The high-level picture is clean and easy to understand. Historically, many Linux kernel privilege escalations relied on fragile timing windows, TOCTOU bugs, or memory races, with Dirty COW being the classic example. Copy Fail, however, behaves much more deterministically with page cache corruption driven through kernel data-flow.

1.2 Page Cache Corruption

Unlike traditional file corruption vulnerabilities, Copy Fail does not directly modify the file stored on disk. Instead, it corrupts the in-memory page-cache representation of the file maintained by the Linux kernel.

If we are familiar with how Linux userspace memory maps into kernel, the concept is trial to understand:

      disk                             kernel
════════════════════════════════════════════════════
   [VICTIM]
┌──────────────┐  mapped into physical memory
│ /usr/bin/su  │──────────────────────────┐
└──────────────┘                          │         
any SUID binary                           │
original bytes                            │    
                                          │
                                          ▼
                  [TARGET]     ┌────────────────────┐
             cached .text page │  page cache page   │
             executable in RAM └──────────┬─────────┘
                                          │
                                          │ Copy Fail
                                          │ corrupts here
   [TRIGGER]    SUID process maps         ▼
┌─────────────┐ corrupted code   ┌─────────────────┐ 
│ User calls  │─────────────────▶│ corrupted .text │
│ /usr/bin/su │                  │ page in cache   │ 
└──────┬──────┘                  └────────┬────────┘                            
       │                                  │
       ▼                 shell code       │
 exected as root  ◀───────────────────────┘

      disk                             kernel
════════════════════════════════════════════════════
   [VICTIM]
┌──────────────┐  mapped into physical memory
│ /usr/bin/su  │──────────────────────────┐
└──────────────┘                          │         
any SUID binary                           │
original bytes                            │    
                                          │
                                          ▼
                  [TARGET]     ┌────────────────────┐
             cached .text page │  page cache page   │
             executable in RAM └──────────┬─────────┘
                                          │
                                          │ Copy Fail
                                          │ corrupts here
   [TRIGGER]    SUID process maps         ▼
┌─────────────┐ corrupted code   ┌─────────────────┐ 
│ User calls  │─────────────────▶│ corrupted .text │
│ /usr/bin/su │                  │ page in cache   │ 
└──────┬──────┘                  └────────┬────────┘                            
       │                                  │
       ▼                 shell code       │
 exected as root  ◀───────────────────────┘

After the page-cache corruption, the victim binary, such as a SUID executable owned by root, can still appear untouched on disk — but the executable bytes consumed by the kernel may already be modified in memory.

That results in a jalibreak on a critical kernel security invariant:

Kernel read-only cached file pages must never become writable through unprivileged users.

1.3 Study Resources

Articles worth reading to have an initial overview of the vulnerability and kernel exploitation, that are referenced throughout this writeup:

• Linux kernel programming: GitHub - PacktPublishing/Linux-Kernel-Programming
• Linux network programming: GitHub - nguyenchiemminhvu/LinuxNetworkProgramming
• Copy Fail official page: Copy Fail — CVE-2026-31431
• Copy Fail official writeup: Copy Fail: 732 Bytes to Root on Every Major Linux Distribution. - Xint