Critical Linux Kernel Cryptographic Template Bug (CVE-2026-31431) Lets Local Users Escalate to Root via Page‑Cache Write

Published: May 24, 2026
Severity: High / Critical
Affected Versions: Linux kernel 5.10 through 6.8 (specific commit range)
CVE ID: CVE-2026-31431

Overview

A logic bug in the Linux kernel’s cryptographic template handling (the “Copy Fail” path) permits an unprivileged local user to write arbitrary data into the page cache of any file they can read. Because the page cache backs the file’s on‑disk contents, this enables direct modification of privileged files (e.g., /etc/shadow, sudoers, or kernel modules) and consequently trivial privilege escalation to root.

Technical Details

  • Root Cause: In crypto/template.c, the fallback path for copying data when the primary cryptographic operation fails incorrectly validates the destination length, allowing a user‑controlled length to exceed the source buffer size.
  • Exploitation Steps:
    1. Open a readable target file (e.g., /etc/passwd).
    2. Invoke a crypto API operation (such as hashing or encryption) with a crafted input that triggers the fallback copy path.
    3. The kernel copies more data than intended into the page cache, overwriting portions of the target file.
    4. Since the page cache is synchronized to disk on sync or via msync, the malicious writes become permanent.
  • Impact: Arbitrary file write as any user with read access to the file → privilege escalation, persistence, or bypass of security mechanisms.
  • Mitigation: Apply the patch released in kernel version 6.8.1 (or backport the fix to affected stable branches). Users unable to update immediately can restrict access to vulnerable crypto interfaces via sysctl or SELinux/AppArmor profiles, though the most reliable remedy is upgrading.

Proof‑of‑Concept Concept (Non‑exploit Code)

/* Illustrative only – does not contain exploit */
int fd = open("/etc/passwd", O_RDONLY);
struct crypt_op cop = { .desc = ..., .len = huge_value };
ioctl(fd, CIOCGCRYPTO, &cop); // triggers flawed copy path

Note: Actual exploit code is omitted for responsible disclosure.

Recommendations

  1. Upgrade to the latest patched kernel (6.8.1 or newer) as soon as possible.
  2. Monitor for unexpected changes to sensitive files using integrity‑checking tools (e.g., auditd, Tripwire).
  3. Restrict local user accounts where feasible and enforce least‑privilege principles.
  4. Review any custom kernel modules that may inadvertently expose the vulnerable crypto path.

References

Tags: cve, linux-kernel, privilege-escalation, security, vulnerability