Mitigating CVE-2026-31431 (“Copy Fail”) in Docker Engine

Summary

CVE-2026-31431, dubbed Copy Fail, is a Linux kernel vulnerability in the AF_ALG crypto subsystem that allows unprivileged users to perform controlled writes to the page cache. Because default Docker Engine profiles permitted AF_ALG sockets, containers on unpatched host kernels could corrupt shared host page caches. Docker's initial mitigation in v29.4.2 blocked AF_ALG sockets and the socketcall syscall via seccomp, but entirely blocking socketcall broke 32-bit binaries and Go runtimes. To resolve compatibility issues, Docker Engine v29.4.3 reverted the seccomp socketcall block and adopted Linux Security Modules to enforce socket restrictions. The updated release configures AppArmor and SELinux policies to block AF_ALG creation across both direct and multiplexed syscall paths while retaining seccomp filtering for defense-in-depth.

Takeaways

1. 1

   Seccomp cannot selectively inspect or block address families inside the socketcall syscall because arguments are passed via userspace pointers that BPF cannot dereference.

2. 2

   Linux Security Modules such as AppArmor and SELinux intercept socket creation at the security_socket_create callback, successfully blocking AF_ALG across both direct socket and multiplexed socketcall entry points.

3. 3

   While Docker Engine v29.4.3 mitigates containerized exploitation via LSM rules and seccomp, systems without an active LSM still leave the socketcall path unblocked unless host kernels are patched or crypto modules blacklisted.