TL;DR: CVE-2026-31431 lets an unprivileged local user escalate to root on most major Linux distributions since 2017, and the attack can corrupt in-memory binaries while leaving disk checks clean, according to Oligo Security. Runtime verification, not file integrity alone, becomes the relevant control when local privilege escalation crosses container and host boundaries.
At a glance
What this is: This is an analysis of CVE-2026-31431, a local Linux privilege escalation flaw that can corrupt in-memory binaries and bypass disk-based integrity checks.
Why it matters: It matters because shared clusters, container hosts, and CI/CD runners can turn a local Linux flaw into a node-level incident if teams rely on file integrity alone.
Context
Copy Fail is a local privilege escalation issue in the Linux kernel that becomes a broader trust problem in shared infrastructure. The article argues that the important failure is not just root access on one host, but the way runtime compromise can evade controls that only inspect disk state.
In containerised and multi-tenant environments, the blast radius can extend from an unprivileged container to a privileged container and then to the host. That makes this an infrastructure governance problem as much as a kernel bug, because the control model has to account for shared execution paths and not just isolated workloads.
Key questions
Q: What breaks when a local Linux privilege escalation flaw can alter in-memory binaries?
A: Disk-based integrity controls break first, because they assume malicious changes will leave a persistent artifact. When the exploit changes what executes in memory instead, file hashes and on-disk scans can still look clean. Teams need runtime visibility into execution behaviour, not just artifact comparison, to detect this kind of compromise.
Q: Why do shared Linux clusters make local privilege escalation more dangerous?
A: Shared clusters collapse the gap between a local foothold and broader system impact. If an unprivileged container can influence a binary used by a privileged container on the same node, the attacker can pivot from local access to node-level compromise. The risk is amplified wherever workloads share execution paths.
Q: What are the signs that a Linux runtime integrity control is failing?
A: Look for AF_ALG socket activity, splice() calls aimed at setuid binaries, unexpected root shell spawning, and trusted binaries behaving anomalously after cryptographic activity. The control is failing when disk state looks normal but process behaviour shows privilege changes or execution paths that should not exist.
Q: How should teams respond when privileged containers share binaries with untrusted workloads?
A: They should treat that design as a blast-radius issue, not only a hardening issue. Shared binaries create a path for local compromise to cross into privileged execution, so teams need workload placement rules, node-level segmentation, and runtime detection that assume a local flaw can become a host problem.
Technical breakdown
How AF_ALG and splice() enable in-memory corruption
The flaw sits in the Linux kernel's authencesn cryptographic template within the AF_ALG API. By chaining AF_ALG sockets with splice() system calls, an attacker can corrupt the page cache used by a setuid binary without modifying the file on disk. That matters because the kernel executes the in-memory page cache, not a fresh read from disk, so the trusted execution path is subverted before conventional checks see any change.
Practical implication: runtime monitoring has to observe kernel and process behaviour, not only compare files on disk.
Why file integrity monitoring misses this class of attack
File integrity monitoring, hash validation, and disk scanning all assume the malicious change will leave a persistent artifact. Copy Fail breaks that assumption by altering what executes in memory while leaving the on-disk binary intact. The result is a false sense of safety: the evidence base looks clean, but the running process has already been poisoned. This is a detection gap, not just a patching gap.
Practical implication: treat disk-based integrity as necessary but insufficient for Linux runtime defence.
How shared containers expand local Linux impact
In shared clusters, an unprivileged container may be able to affect binaries that are shared with a privileged container on the same node. Once a privileged workload consumes the corrupted binary, the attacker can use that execution path as a pivot to the host. That turns a local flaw into a cross-boundary breach path, which is why container isolation and node hardening must be assessed together rather than separately.
Practical implication: review shared image and node assumptions wherever untrusted workloads coexist with privileged ones.
Threat narrative
Attacker objective: The objective is root-level control on the host or node while keeping the on-disk system state looking clean.
- Entry begins with an unprivileged local user or container already present on the target system, which is enough to start the exploit chain.
- Credential or privilege access follows when the attacker uses AF_ALG sockets and splice() to corrupt the in-memory execution path of a setuid binary.
- Escalation occurs when the poisoned binary runs as root, and in shared container environments that privilege can be used to pivot toward the host.
- Impact is node-level compromise, with the attacker able to bypass disk-based detection and extend control beyond the original local boundary.
Breaches seen in the wild
- Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Runtime evidence has become a governance requirement, not an optional detection enhancement. Copy Fail works because file integrity tools assume malicious change must persist on disk. That assumption fails when the attacker alters the in-memory execution path instead. The implication is that Linux governance now has to include runtime verification as a first-class control, especially where setuid binaries and shared workloads coexist.
Local privilege escalation in shared clusters is really a blast-radius problem. The article shows that an exploit starting from an unprivileged local context can move from container to privileged container to host. That means the security question is no longer whether one node is hardened, but how far a compromised execution path can propagate across shared infrastructure. Practitioners need to treat cluster topology as part of identity and privilege risk.
Disk-based trust assumptions are designed for a slower attack model. Copy Fail demonstrates that the filesystem can remain clean while the active process is compromised. That leaves traditional post-event inspection with little useful evidence and shifts assurance toward behavioural telemetry. The practical conclusion is that defenders must validate what is executing, not just what is stored.
Kernel-level exploitability is now a shared responsibility between platform and security teams. The vulnerability is in the Linux kernel, but the operational risk appears in container orchestration, CI/CD runners, and multi-tenant hosts. That crosses classic team boundaries and creates a governance gap if platform teams assume patching alone resolves exposure. The implication is that runtime policy, workload placement, and patch cadence have to be managed together.
Copy Fail names an identity governance blind spot: trusted execution without trusted observation. The system assumes a privileged binary will remain faithful between file inspection and execution. That assumption fails when the actor can change what runs without changing what is stored. The implication is that integrity programmes need a concept of runtime trust, not just artifact trust.
What this signals
Runtime trust is the new control boundary. A Linux host can be technically patched and still be operationally exposed if security teams only inspect the filesystem. Copy Fail shows why the control plane must include runtime behaviour, especially where privileged binaries execute in shared infrastructure.
Shared clusters force defenders to think in terms of blast radius rather than single-host hygiene. When an exploit can move from a local container to a privileged container and then to the host, workload placement and runtime telemetry become governance decisions, not just engineering details.
For practitioners
- Patch vulnerable Linux distributions first Prioritise hosts running vulnerable kernel versions on Kubernetes nodes, multi-tenant systems, CI/CD runners, and other environments that execute untrusted code. Patch availability is the primary remediation path, and exposure should be triaged by shared-infrastructure impact rather than by workload criticality alone.
- Reduce exposure where patching is delayed Disable the vulnerable algif_aead module where operationally feasible, or block AF_ALG socket creation with seccomp policies until fixes are deployed. This is a containment step for systems that cannot be patched immediately and should be paired with strict change tracking.
- Add runtime behaviour detections Monitor for AF_ALG socket use, splice() activity targeting setuid binaries, unprivileged processes touching privileged execution paths, unexpected root shells, and anomalous execution of trusted binaries after cryptographic activity. Correlation matters because no single indicator is conclusive on its own.
- Review shared-cluster trust boundaries Map where unprivileged workloads share images, nodes, or binaries with privileged containers, and identify paths where a local exploit could become a node-level breach. This should feed platform hardening decisions and workload placement rules for shared infrastructure.
Key takeaways
- Copy Fail shows that a local Linux flaw can become a system-wide issue when defenders trust disk state more than runtime behaviour.
- The article demonstrates that in-memory corruption can bypass file integrity monitoring, which leaves traditional detection with little evidence.
- Runtime monitoring, patching vulnerable kernels, and reducing shared-cluster exposure are the controls that matter most for this class of risk.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0006; TA0004; TA0008 — Credential Access; Privilege Escalation; Lateral Movement | The article centers on local privilege escalation and pivoting through shared infrastructure. |
| Recommendation — Map the exploit path to credential access, privilege escalation, and lateral movement detections. | ||
| CIS Controls v8 | CIS-5 — Account Management | Privileged binaries and shared workloads create account and execution paths that need strict governance. |
| Recommendation — Tighten account and execution-path governance for privileged workloads on shared Linux systems. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The attack abuses excessive execution authority in shared infrastructure. |
| Recommendation — Review entitlements that let untrusted workloads reach privileged execution paths. | ||
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The article shows how excessive privilege in shared execution paths widens blast radius. |
| Recommendation — Reduce overprivileged service and workload accounts that can reach shared binaries or nodes. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Least privilege is directly implicated when local access can escalate to root on shared hosts. |
| Recommendation — Enforce least privilege on Linux hosts and workload execution paths that cross container boundaries. | ||
Key terms
- Local Privilege Escalation Amplifier: A host condition where a local vulnerability becomes far more dangerous because the affected machine already has access to valuable systems. The escalation may be technically local, but the impact becomes organisational when the host can reach signing, deployment, or cloud control planes.
- Runtime Verification: Runtime verification is the practice of checking what an identity is doing while it is active, rather than relying only on provisioning-time controls. For autonomous agents, it means monitoring prompts, tool use, outputs, and policy violations as actions unfold so harmful behavior can be contained early.
- Page-cache corruption: A memory corruption pattern where data held in the kernel page cache is altered in place instead of being changed on disk. In Linux escalation cases, this matters because the attacker can influence what the system executes or trusts without leaving a normal file-modification trail.
- Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on May 15, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org