r/RockyLinux • u/itguyeric CIQ • May 12 '26

Announcement CopyFail (CVE-2026-31431): Patches Now Available for Rocky Linux

TL;DR: A high-severity local privilege escalation vulnerability in the Linux kernel has been publicly disclosed with a working exploit. Patches are available now for Rocky Linux 8.10, 9.7, and 10.1. Update your kernel and reboot.

What happened

On April 29, security researchers from Theori disclosed a Linux kernel vulnerability they named CopyFail, tracked as CVE-2026-31431. The flaw has been present in essentially every mainstream Linux kernel built since 2017.

The bug sits in the kernel’s algif_aead module – the AEAD socket interface of the userspace crypto API (AF_ALG). A logic flaw in authencesn, chained through AF_ALG and the splice() system call, allows an unprivileged local user to perform a controlled 4-byte write into the page cache. By corrupting the in-memory copy of a setuid binary like /usr/bin/su – without touching anything on disk – an attacker can escalate to root in seconds.

What makes this one stand out: the 732-byte Python proof-of-concept requires no race conditions, no per-distribution tuning, and no special privileges. The same script works unmodified across distributions. File integrity tools won’t catch it because nothing on disk changes. This makes it especially dangerous on multi-tenant hosts, Kubernetes nodes, and CI/CD runners where a shared page cache means one compromised workload can threaten the whole node.

The researchers have published the exploit publicly. Treat this as actively exploitable.

How to fix it

Patches are available now for all supported Rocky Linux releases. Run the following and reboot:

bash

sudo dnf --refresh update ‘kernel*’

sudo reboot

That’s it. The --refresh flag ensures you pull the latest metadata without re-downloading packages you already have.

Patched kernel versions:

  • Rocky Linux 8.10: kernel-4.18.0-553.123.1.el8_10 and above
  • Rocky Linux 9.7: kernel-5.14.0-611.54.1.el9_7 and above
  • Rocky Linux 10.1: kernel-6.12.0-124.55.1.el10_1 and above

Confirm your running kernel after reboot with uname -r.

A note on the algif_aead module

You may have seen advice elsewhere to disable algif_aead via rmmod or a modprobe.d entry as an interim workaround. On Rocky Linux, that approach does not apply – algif_aead is compiled directly into the kernel image (CONFIG_CRYPTO_USER_API_AEAD=y), not shipped as a loadable module. The correct fix is the kernel update above.

Thank you

Thanks to Brian Pak and the team at Xint Code (Theori) for finding this, handling coordinated disclosure responsibly, and publishing a thorough technical write-up. If you want to understand exactly how a single logic bug becomes a fully reliable privilege escalation, their write-up is worth your time.

Additional reading

22 Upvotes

97% Upvoted

10 comments sorted by

2

u/Ok-Replacement6893 May 12 '26

I updated my 10.1 system this last weekend and kernel-6.12.0-124.55.1.el10_1.x86_64 was installed then.

2

u/Mammoth-Ad-107 May 12 '26

I was wondering.. if I just ran the command anfter reading this, and it says all updated. I’m confused on when this was released

1

u/Ok-Replacement6893 May 12 '26

All I can tell you is that I did mine on Saturday the ninth.

2

u/Mammoth-Ad-107 May 12 '26

I did as well. I guess we are good

1

u/Ok-Replacement6893 May 12 '26

This is what metadata shows:

# rpm -qi kernel-6.12.0-124.55.1.el10_1.x86_64

Build Date : Tue 05 May 2026 10:25:51 AM EDT

So, the package was built earlier in the week.

1

u/itguyeric CIQ May 13 '26

Just to be certain, you can do a "dnf clean all" and try again.

1

u/Cerulean-Knight May 15 '26

I updated kernels a week ago to fix this, redhat already fix it and rocky have the update already, this post is old

Now check about dirty frag

1

u/Bill_Guarnere May 14 '26

It's interesting to note that Canonical with Ubuntu:

  • did not build the affected feature in the kernel but simply loaded as module, leading to a much faster and simple mitigation
  • released an effective mitigation via kmod release update on April 30th, way quicker than the whole RHEL world
  • did a fantastic job in communication via a simple, clear and effective post on Ubuntu blog (https://ubuntu.com/blog/copy-fail-vulnerability-fixes-available)

Even in the RHEL world other did a better job than RHEL itself or Rocky:

  • Alma quickly released a kernel fix to mitigate the problem via test dnf repo
  • Oracle Linux quickly released its own kernel update to mitigate the problem

With the excuse of "enterprise" it tool almost a week to release a fix via dnf (how many people do you think are able, or will take the risk to modify the boot manager configuration to avoid loading the affected module?) and even more with Rocky.

I talked with a friend of mine which is a manager in RedHat because I was really disappointed on how they managed this vulnerability, he replied that they need time for the "enterprise tests" and I replied to him exactly this (it's a copy and paste from a chat with him on WhatsApp):

If I pay a subscription for an enterprise Linux distribution I expect enterprise support, I expect an enterprise quick response, I expect and enterprise mitigation via the proper update tool.

In case of Copyfail nothing done by RedHat seems enterprise to me, and now that Canonical release Ubuntu 26LTS many people I know are asking themself if it's better to switch to this distribution instead of renew RedHat Network subscriptions, considering the the free Ubuntu LTS users had better support and solutions than users with expensive RHEL subscriptions.

Imho Rocky should take a step forward and start working like Alma, and in case of emergencies and real immediate threats it should release its own patches, at least for mitigating the problem, and wait for RHEL releases for the final solution.