Linux AF_ALG + splice Local Privilege Escalation (CVE-2026-31431)

Kernel LPE via AF_ALG crypto sockets and splice() heap corruption; public PoCs claim Ubuntu/RHEL/Amazon/SUSE reachability; patch and blacklist algif_aead.

Summary

CVE-2026-31431 is a Linux kernel local privilege escalation involving the AF_ALG cryptographic socket interface and splice() zero-copy paths. Public PoCs indexed on Sploitus (week of 2026-07-25) describe heap grooming through setsockopt / sendmsg on AEAD AF_ALG sockets, then splice-driven corruption leading to credential overwrite / root. Claims cover recent enterprise kernels (e.g. Ubuntu 24.04 / 6.17-class, Amazon Linux 2023, RHEL 10.1, SUSE 16) when algif_aead is loadable.

CVSS on the Sploitus card: 7.8. OFFSITE.DARK indexes the advisory metadata and mitigations only — no exploit reproduction.

Technical Details

Aspect	Detail
CVE	CVE-2026-31431
Subsystem	AF_ALG (`algif_aead`) + splice
Class	Incorrect resource transfer / memory corruption (CWE family varies by tracker)
Privileges	Local unprivileged (module must be available)
Mitigations (interim)	Blacklist/unload `algif_aead`; kernel upgrade

Public write-ups nickname the issue around AF_ALG + splice corruption (“Copy Fail” in one PoC README). Treat PoC reliability claims as unverified until distro advisories confirm.

Impact

Standard-user → root on multi-tenant hosts, CI runners, and containers that still expose host AF_ALG. Crypto offload modules are often present on desktop/server kernels even when unused.

Mitigation

Apply vendor kernel updates that include the CVE-2026-31431 fix; reboot into the patched kernel.
Until patched: install algif_aead /bin/false in modprobe.d and rmmod algif_aead if loaded.
Restrict untrusted local code execution on shared hosts.
Monitor for unusual AF_ALG socket creation + splice activity from non-crypto workloads.
Re-check NVD/distro trackers for confirmed affected/fixed version ranges.

Sources

→ Source