Copy Fail (CVE‑2026‑31431) Enables Unprivileged Page‑Cache Corruption for Root Escalation
The Linux kernel’s AF_ALG crypto socket interface can be abused by any unprivileged user to corrupt the page cache of arbitrary files, such as /usr/bin/sudo, without any filesystem changes, enabling root escalation. The bug affects kernels 4.14–6.19 and 7.0 RCs, is confirmed in the wild, and appears in CISA’s KEV catalog.