CVE-2026-31431: Linux Kernel AF_ALG Local Privilege Escalation and Docker Mitigation

Vulnerability Overview Vulnerability Name: CVE-2026-31431 ("Copy Fail") Description: This is a Linux kernel vulnerability that allows unauthorized users to perform controlled writes to the page cache via the AF_ALG socket. Attackers can temporarily modify the contents of any readable file, leading to the corruption of setuid binaries and thereby gaining local root privileges. Publication Date: May 27, 2026 Impact Scope Affected Systems: - Docker Engine versions prior to v29.4.3 - Debian and RHEL 9 (RHSB-2026-002) - All unpatched Linux kernel versions released since 2017 Impact Level: - Attackers can corrupt setuid binaries by modifying the page cache within a container, subsequently affecting the host and other containers. - No special capabilities or privileges are required; a default container security profile suffices. Remediation 1. Patch the Kernel: - Check for and apply kernel updates addressing CVE-2026-31431. 2. Upgrade Docker Engine: - Upgrade to Docker Engine v29.4.3 or later. - Execute (or equivalent) to apply the update. 3. Mitigation Measures: - Blacklist Kernel Modules: Add and to . - Custom Seccomp Profile: Deny AF_ALG using the option or the setting in . Additional Information Seccomp (v29.4.2): Updated the default seccomp profile in Docker Engine to block AF_ALG sockets. LSM-based Enforcement (v29.4.3): Employs AppArmor and SELinux for stricter control over socket creation. Conclusion Security is a multi-layered process; a single measure may be insufficient. Kernel vulnerabilities will continue to emerge; container runtimes are often the optimal location for rapid deployment of mitigation measures. Keeping Docker Engine updated is an effective method for protecting workloads from kernel vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-31431: Linux Kernel AF_ALG Local Privilege Escalation and Docker Mitigation