Copy Fail 732 Bytes to Root on Every Major Linux Distributio...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://xint.io/blog/copy-fail-linux-distributions
• Blog Title: Copy Fail: 732 Bytes to Root on Every Major Linux Distributions
• Suggested Section: Linux Hardening -> Linux Privilege Escalation (add a page for CVE-2026-31431 / page-cache overwrite primitives via AF_ALG+splice; cross-reference existing Dirty Pipe/Dirty COW style LPEs)

🎯 Content Summary

Title/Context
The post discloses Copy Fail (CVE-2026-31431), a Linux kernel logic bug involving the authencesn AEAD cryptographic template. It allows an unprivileged local user to trigger a deterministic, controlled 4-byte write into the page cache of any file readable by that user. Because the page cache is what the kernel actually serves for read()</code...

🔧 Technical Details

AF_ALG + splice() “page-cache as input pages” trick: If you can feed a file into a pipe and then splice() it into a kernel consumer (here, AF_ALG crypto), the consumer’s scatterlist may end up referencing the file’s page-cache pages by reference (zero-copy). Any bug that later treats those pages as writable (directly or via chained scatterlist segments) becomes a primitive to modify a file’s in-memory contents system-wide (affecting read(), mmap(), execve()).

Scatterlist boundary-crossing write via incorrect “in-place” AEAD composition: If a framework constructs an in-place operation (req->src = req->dst) and appends extra scatterlist segments (e.g., authentication tag) into the destination via sg_chain(), any algorithm that writes beyond its contractual output length can cross into the appended segments. When those appended segments are backed by ...

🤖 Agent Actions

I’m mapping the repo first and then reading the existing Linux LPE and page-cache write content so the update lands in the right place and doesn’t duplicate what HackTricks already has.
I found two plausible homes: the broad Linux privilege-escalation index and the dedicated linux-kernel-exploitation subsection under it. I’m reading several existing kernel-focused pages now to match structure and decide whether this belongs as a new dedicated page or a short subsection.
The repo doesn’t already cover this primitive, so I’m adding a dedicated Linux kernel LPE page under the existing linux-kernel-exploitation subsection and wiring it into SUMMARY.md. The page will stay focused on the reusable trick: AF_ALG + splice() turning readable file page-cache pages into a writable destination scatterlist when an AEAD implementation writes past its contract.
I’ve finished source validation and I’m writing the new page now. The edit will keep exploit details high-signal and centered on the transferable primitive, with mitigations and references at the end.
The page content is in place and the navigation entry resolves to the new file path. I’m doing one last validation pass now to catch any structural issue before closing out.
Added a new page at copy-fail-af_alg-splice-page-cache-overwrite-cve-2026-31431.md and linked it from SUMMARY.md.

The content is focused on the reusable technique, not just the CVE: AF_ALG + splice() exposing page-cache pages to a writable destination scatterlist, authencesn writing 4 bytes past the AEAD output contract, why that becomes a deterministic page-cache overwrite primitive, the typical setuid-root LPE flow, and patch/mitigation guidance with references to the Xint write-up, copy.fail, and upstream Linux commits.

I re-read the new page and summary entry after editing. I could not run mdbook build because mdbook is not installed in this environment.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://xint.io/blog/copy-fail-linux-distributions

Content Categories: Based on the analysis, this content was categorized under "Linux Hardening -> Linux Privilege Escalation (add a page for CVE-2026-31431 / page-cache overwrite primitives via AF_ALG+splice; cross-reference existing Dirty Pipe/Dirty COW style LPEs)".

Repository Maintenance:

• MD Files Formatting: 973 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0