Xint and the copy.fail teaser site detail a logic flaw in the Linux kernel’s AF_ALG AEAD path where authencesn performs scratch writes past the output buffer into page-cache pages chained in via splice() and sg_chain(), yielding a deterministic 4-byte page-cache write from an unprivileged user.
A 732-byte Python exploit edits the page cache of a setuid binary for instant root across Ubuntu 24.04, Amazon Linux 2023, RHEL 10.1, and SUSE 16 (kernels 6.12 through 6.18), with no race and no offsets.
Mainline commit a664bf3d603d reverts AEAD to out-of-place operation, CVE-2026-31431 landed April 22, and disclosure followed April 29.
A follow-up covers how Cloudflare detected the exploit and blocked AF_ALG binds with eBPF while patched kernels rolled out.
If your distro kernel still ships in-place AEAD nine years after it was a bad idea, that’s a choice.
