Security Notice for Linux Kernel CVE-2026-31431 ('Copy Fail')
Description
A security vulnerability (CVE-2026-31431) has been found in the Linux kernel that could be exploited to allow privilege escalation to root by any authorized user of the system who can (1) create sockets, and (2) have read and execute permissions on at least one setuid binary (e.g. sudo, fusermount, passwd). Any user account with shell access will generally meet these criteria. The attack does not require the attacker to have knowledge of the unprivileged user's password to execute; simply having control of an unprivileged local user account that can create sockets and execute at least one setuid binary is sufficient.
The vulnerability allows the page cache of a loaded binary to be arbitrarily changed, so it may have impact beyond privilege escalation: for example, an attacker could use this vector from inside a compromised container to corrupt the page cache for a file that is on a layer that is shared between containers, and it would be corrupted for all containers that use that layer. Similarly, if a file that was bind-mounted into the container from the host system was corrupted, it would also affect the host system's version of that file.
All versions of Linux kernel since 4.14.0, released in 2017, are affected. The vulnerability has patches available in upstream Linux kernel releases for all currently-supported branches, including 5.15 (patched in 5.15.204), 6.1 (patched in 6.1.170), and 6.6 (patched in 6.6.137).
Affected Versions
All operating systems based on an affected kernel version, including Torizon OS 6 and Torizon OS 7 releases prior to May 2026 (6.0.0 - 6.8.7, 7.0.0 - 7.6.0) are affected by this vulnerability. On Torizon OS, CONFIG_CRYPTO_USER_API_AEAD is compiled as built-in, meaning the module cannot be disabled at runtime from userspace.
What Should I Do?
Toradex is planning a patch release for both BSP 6 and BSP 7, as well as corresponding Torizon releases. We are currently completing our release testing, and these patch releases will be available very soon. You can sign up to be notified as soon as these releases are available using the Subscribe to Security Updates button at the top of this page.
Although this vulnerability is serious, in the context of most embedded devices it is only one link in an exploit chain. If your device has well-protected defenses against allowing users to execute arbitrary code, this vulnerability cannot be operationalized. Therefore, it may not merit an emergency out-of-band patch.
Torizon OS Users
If you are using an affected version of Torizon OS, we recommend that you upgrade to these latest releases as soon as they are available. If you have a threat model and use case that indicates this vulnerability affects your device immediately, we recommend issuing an update that blacklists this subsystem on the kernel command line. Add initcall_blacklist=algif_aead_init to your kernel command line to enable this mitigation. See our documentation on customizing kernel arguments in Torizon OS for detailed instructions on how to do this.
Toradex BSP/Custom Yocto Linux Distribution Users
The Toradex BSP layer does not automatically enable the userspace interface for AEAD cipher algorithms (CONFIG_CRYPTO_USER_API_AEAD is not set). However, if your custom Linux image is built with this config option set, you are likely affected. We recommend auditing your image and kernel config to determine if you have a vulnerable version, and patching/upgrading as soon as the updated BSP releases are available.
If you have a threat model and use case that indicates this vulnerability affects your device immediately, we recommend issuing an update that blacklists this subsystem on the kernel command line, or blacklists the kernel module if compiled as a module.
Q&A
- I don't have any unprivileged Linux user accounts on my device. Am I still affected?
- In principle, no. If you are absolutely certain that you do not have any unprivileged Linux user accounts, i.e. the only user on the device is root, you are not affected. However, note that most Linux distributions include the Name Service Switch, and allow users to be defined in places other than
/etc/passwd, for example via nss-systemd. Check your/etc/nsswitch.conffile for all potential places where users may be defined, and/or runcompgen -uto see the current list of defined users on your system.
- In principle, no. If you are absolutely certain that you do not have any unprivileged Linux user accounts, i.e. the only user on the device is root, you are not affected. However, note that most Linux distributions include the Name Service Switch, and allow users to be defined in places other than
- I don't allow shell access at all on my device. Am I still affected?
- Possibly. The only preconditions for executing this attack are that the unprivileged user must be able to create and make use of an AF_ALG socket, and read and execute any suid binary. If you are following defense-in-depth best practices, like running applications and services with the least privilege they require, this page cache vulnerability strips away a very important layer of defense: any compromise of software running in an unprivileged user account that allows an attacker to execute arbitrary code will now also allow privilege escalation to root. Therefore, even if your non-root user accounts have login shells disabled, it is strongly recommended to update.
- The only unprivileged Linux user accounts on my device are inside application containers. Am I affected?
- Possibly. The page cache is shared across the host. Even a container can be affected by this vulnerability and result in a container escape primitive, not just LPE.