CVE-2026-31431 (Copy Fail): The 9-Year-Old Linux Kernel Flaw Affecting CloudLinux, Ubuntu, RHEL and Beyond

On April 29, 2026, the security firm Theori disclosed a 9-year-old design flaw at the heart of the Linux kernel: CVE-2026-31431, codenamed Copy Fail. Any user with a shell on the system can run a 732-byte Python script and obtain root. No race condition required — this is more reliable than Dirty Pipe or Dirty Cow.

Affected Systems

Virtually every major Linux distribution shipped since 2017 is vulnerable:

How the Exploit Works

The flaw lives in the Linux kernel's algif_aead module — the AEAD socket interface of the kernel's userspace crypto API (AF_ALG). Three separate changes, each reasonable in isolation, interact catastrophically:

1. 2011 — The authencesn algorithm was added; it uses the destination buffer as scratch space when rearranging IPsec Extended Sequence Number bytes.
2. 2015 — AEAD support was added to AF_ALG sockets, exposing the crypto subsystem to unprivileged userspace.
3. 2017 — An in-place optimization in algif_aead.c allowed source and destination scatterlists to share page cache pages.

An attacker chains an AF_ALG socket with splice() to map any readable file's page cache into a writable scatterlist. The authencesn scratch write then places 4 controlled bytes into the page cache — typically targeting /usr/bin/su or another setuid binary. Seconds later: root shell.

The mainline patch (a664bf3d603d) was committed on April 1, 2026. Distributions are rolling out fixes now.

Is CloudLinux Specifically Affected?

How Panelica Differs from CloudLinux Stacks

Defense-in-Depth — What Actually Helps

Userspace isolation tools provide partial protection but are not a substitute for the kernel patch. Here is an honest evaluation:

The structural advantage of well-designed shared hosting environments:

• SFTP-only customer accounts cannot launch a Python script directly. The 732-byte exploit needs a shell or scripting runtime.
• Hardened PHP-FPM pools with exec, system, passthru, shell_exec, popen disabled prevent web-shell-based exploitation.
• Full SSH access (bash-capable accounts) should be opt-in, granted only to administrators or trusted developers.

What You Must Do Now

apt update && apt upgrade -y linux-image-generic
reboot

dnf update -y kernel
reboot

kcarectl --info
kcarectl --update

echo "install algif_aead /bin/false" | sudo tee /etc/modprobe.d/disable-algif-aead.conf
sudo rmmod algif_aead 2>/dev/null || true

sudo grubby --update-kernel=ALL --args="initcall_blacklist=algif_aead_init"
sudo reboot

lsmod | grep algif_aead     # expect empty output

Quick Diagnostic Commands

Run these on your server to assess exposure:

# Running kernel
uname -r

# All installed kernel images (look for newer ones not yet booted)
apt list --installed 2>/dev/null | grep linux-image | tail -3
# RHEL family:
rpm -qa | grep kernel | tail -3

# Is algif_aead modular or built-in?
grep CRYPTO_USER_API_AEAD /boot/config-$(uname -r)

# Currently loaded?
lsmod | grep algif_aead

# Already blacklisted?
ls /etc/modprobe.d/ | grep -i algif

Closing Thoughts

Copy Fail is a direct hit against the foundational trust boundary of shared servers and multi-tenant environments. The good news: the patch landed quickly, and the temporary mitigation is straightforward. The bad news: the bug was present, exploitable, and unnoticed for nine years.

Action checklist for hosting operators:

1. Update kernels on all production servers
2. Reboot, or use KernelCare for live patching
3. If reboot is not feasible, blacklist algif_aead
4. Audit which accounts have full SSH shell access
5. Verify PHP-FPM disable_functions lists across all customer pools
6. Notify customers running Docker workloads that host kernel patching is required

For CloudLinux operators specifically: confirm with your provider that the CL7h/CL8 beta-channel patch or the CL9/CL10 AlmaLinux test-repo patch has been applied. KernelCare subscribers should verify the live patch is active with kcarectl --info.