// A Decade-Old Linux Kernel Flaw Exposes Widespread Privilege Escalation Risk

A Small Exploit With Broad Reach

The proof-of-concept exploit is unusually compact, consisting of just 732 bytes of Python code using only standard libraries. It does not rely on race conditions, memory offsets, or kernel-specific tailoring, which are often barriers in exploitation. According to the researchers, the same exploit was successfully executed on several distributions, including Ubuntu, Amazon Linux, RHEL, and SUSE, with similar behavior expected elsewhere. The attack assumes an initial foothold on a system. From there, any unprivileged user can run the script and gain full root access. Variants of the exploit have also appeared in other languages such as C and Go, reducing dependency on Python and increasing portability.

The Core Issue: Page Cache Manipulation

At the center of the vulnerability is the Linux kernel’s page cache, which stores file data in memory to improve performance. The exploit allows an attacker to overwrite small portions of this cached data, specifically targeting binaries that run with elevated privileges. The demonstrated method modifies the in-memory version of the /usr/bin/su binary. When executed, the system loads the altered version from memory instead of disk, effectively running attacker-controlled code with root privileges. The same technique could theoretically be applied to other privileged binaries like sudo, passwd, or pkexec.

How Multiple Features Intersected

The flaw emerges from the interaction of several kernel features that are otherwise considered safe when used independently. One of these is the AF_ALG interface, which enables user-space access to hardware-accelerated cryptographic operations without special privileges. Data is passed into these operations using splice(), a mechanism that transfers data between file descriptors without copying it into user space. This process routes data through the page cache directly.

The vulnerability lies in a cryptographic component known as the “authencesn” template, which combines encryption and authentication. During its operation, it writes four bytes beyond its intended buffer and does not restore them. This alone would not have been critical, but a performance optimization introduced in 2017 caused input and output buffers to share the same memory region. As a result, the unintended writes began affecting the page cache directly. By repeatedly invoking this behavior, an attacker can overwrite specific parts of cached files in memory, eventually injecting malicious code into executables.

Implications for Containers and Shared Systems

The issue is particularly relevant in environments where multiple users or workloads share the same kernel. Containerized systems, including those managed by Kubernetes or Docker, rely on a shared kernel and common page cache. In such setups, an attacker operating within one container could potentially escape isolation and compromise the host system, affecting all other containers running on the same node. This has implications for cloud infrastructure, CI/CD pipelines, and any multi-tenant system where untrusted code may be executed.

Limited Forensic Visibility

One notable characteristic of the exploit is its lack of persistence. Since the modifications occur only in memory, they are not written to disk. When the sy tem reboots or the cache is cleared, the original files are restored. This behavior makes detection more difficult. A forensic analysis based on disk images would not reveal evidence of tampering, as the altered binaries never exist outside of memory.

Mitigation and Patch Availability

A fix has been committed to the Linux kernel, addressing the underlying issue by reverting the in-place buffer handling and adjusting how cryptographic data is processed. Kernel maintainers have made patches available through the stable release channels.

For systems where immediate patching is not feasible, several mitigation steps have been suggested. These include disabling the affected cryptographic module, restricting access to the AF_ALG interface, and applying mandatory access control policies to limit which processes can interact with these kernel features.

Conclusion

The disclosure of CVE-2026-31431 highlights how subtle interactions between independent kernel features can lead to significant security gaps. The exploit’s simplicity and cross-distribution reliability make it notable, especially in shared or containerized environments. While patches are available, the extent of exposure depends on how quickly systems are updated and whether mitigations are applied in the interim.