CVE-2026-31431 Patch

ROCK 5 Series
1

On April 29, 2026, a high-severity local privilege escalation (LPE) vulnerability known as “Copy Fail” (CVE-2026-31431) was disclosed.
The flaw resides in the kernel’s cryptographic subsystem (crypto/algif_aead.c). By chaining an AF_ALG socket operation with the splice() system call, an unprivileged local user can force a zero-copy write directly into the kernel’s page cache, allowing them to overwrite setuid-root binaries in memory and gain instant root access.

Due to the kernel configuration (CONFIG_CRYPTO_USER_API_AEAD=y), standard modprobe mitigation strategies do not work on this build.

The source-level kernel patch for Joshua Riek’s Ubuntu 24.04 OS, can be found at GitHub.

image
image866×629 23.5 KB

2

Hi, and thanks for the OP.

Do you know if an official update is being prepared?

3

Joshua Riek’s Ubuntu repository isn’t maintained anymore.
As soon as this “Copy Fail” was discovered, Joshua archived the repo.
Because lots of people still using this OS, I’ve published the fix based on the official patch.