CVE‑2026‑31431 “Copy Fail” Lets Unprivileged Users Escalate to Root in Rootless Containers
Patch kernel to 6.19.12 or later to mitigate CVE-2026-31431.
Patch kernel to 6.19.12 or later, or upgrade Fedora to a patched kernel; verify Podman rootless containers are not vulnerable.
Summary
On 29 April 2026 a new Linux kernel flaw, CVE‑2026‑31431, was publicly disclosed. The bug, nicknamed “Copy Fail,” allows an unprivileged process to perform an out‑of‑bounds write through the AF_ALG cryptographic API. By injecting shellcode into the page cache of a readable file—most commonly the setuid‑root binary /usr/bin/su—an attacker can obtain a root shell on the host. The vulnerability originates from a 2017 in‑place optimisation of the algif_aead scatterlist that omitted necessary bounds checks.
The flaw is especially dangerous for rootless Podman containers. In this model, a container runs as root inside a user namespace but is mapped to the host UID of the unprivileged user. Podman’s fork/exec model and the capabilities granted to the container root (chown, setuid, net_bind_service) enable the attacker to perform privileged operations within the container. While the container’s root is still limited to the host user’s permissions, the exploit provides a reliable container escape that can be leveraged for further attacks. Docker’s rootful daemon behaves differently, as root inside the container maps to host root, so the vulnerability is specific to rootless Podman.
Cloudflare’s response demonstrates a rapid and disciplined security posture. Their custom kernel builds, based on LTS 6.12 and 6.18, had already incorporated the upstream patch that reverts the unsafe optimisation. Once the CVE was public, Cloudflare’s security team immediately mapped the blast radius, validated that their behavioural detection would flag the exploit chain, and began hunting for signs of exploitation in the previous 48 hours. No customer data was exposed and no services were disrupted. Engineering teams built a runtime mitigation and rolled out the updated kernel across the fleet on the existing four‑week Edge Reboot Release cycle, underscoring the effectiveness of proactive patching and detection.
The incident highlights the importance of defense‑in‑depth measures for containerised workloads and the need to keep custom kernel builds up to date with upstream security fixes. It also serves as a reminder that even seemingly isolated bugs—such as an optimisation in a cryptographic API—can have far‑reaching consequences when combined with modern containerisation practices.
Key changes
- CVE-2026-31431 corrupts /usr/bin/su page cache via AF_ALG socket writes
- Exploit injects a full ELF payload using sendmsg and splice
- Rootless Podman containers contain the escalation by rejecting authencesn writes
- Kernel 6.17.x is vulnerable; patch backported to 6.19.12
- Exploit uses setuid(0) and execve("/bin/sh") for privilege escalation
- Strace shows socket, bind, setsockopt, sendmsg, splice, execve sequence
- Kernel patch prevents authencesn scratch writes
- Rootless containers remain safe but any container on vulnerable kernel is at risk