Mitigating CVE-2026-31431 (“Copy Fail”) in Docker Engine

Summary

CVE-2026-31431, dubbed Copy Fail, is a Linux kernel vulnerability in the AF_ALG crypto subsystem that allows unprivileged users to perform controlled writes to the page cache. Because default Docker Engine profiles permitted AF_ALG sockets, containers on unpatched host kernels could corrupt shared host page caches. Docker's initial mitigation in v29.4.2 blocked AF_ALG sockets and the socketcall syscall via seccomp, but entirely blocking socketcall broke 32-bit binaries and Go runtimes. To resolve compatibility issues, Docker Engine v29.4.3 reverted the seccomp socketcall block and adopted Linux Security Modules to enforce socket restrictions. The updated release configures AppArmor and SELinux policies to block AF_ALG creation across both direct and multiplexed syscall paths while retaining seccomp filtering for defense-in-depth.

Context

CVE-2026-31431 (Copy Fail) is a Linux kernel privilege escalation flaw in the algif_aead module of the AF_ALG crypto subsystem affecting unpatched kernels since 2017. An unprivileged user with AF_ALG socket access can perform controlled writes to the shared page cache, modifying readable files across the host and other containers. Because public disclosure occurred before many distributions released kernel patches, Docker Engine sought to mitigate exposure for default container configurations on vulnerable hosts.

Approach / What changed

Docker Engine v29.4.2 initially blocked socket(AF_ALG) and socketcall via seccomp, but blocking socketcall broke 32-bit workloads and Go runtimes using GOARCH=386. Docker Engine v29.4.3 reverted the socketcall seccomp deny and shifted enforcement to Linux Security Modules, adding deny network alg to the default AppArmor profile and providing a SELinux CIL policy module denying alg_socket creation for container domains. The socket(AF_ALG) seccomp filter was retained as defense-in-depth for direct socket syscalls.

Takeaways

• Seccomp cannot selectively inspect or block address families inside the socketcall syscall because arguments are passed via userspace pointers that BPF cannot dereference.
• Linux Security Modules such as AppArmor and SELinux intercept socket creation at the security_socket_create callback, successfully blocking AF_ALG across both direct socket and multiplexed socketcall entry points.
• While Docker Engine v29.4.3 mitigates containerized exploitation via LSM rules and seccomp, systems without an active LSM still leave the socketcall path unblocked unless host kernels are patched or crypto modules blacklisted.

Related reading

• Docker · Aug 18, 2026

  17,600 Actions: Agent Security Is a Systems Problem

  Security incidents involving AI agents, such as the OpenAI and Hugging Face event where attackers executed 17,600 actions, demonstrate that system security cannot rely entirely on manual human review. Managing agent velocity requires dedicated system-level controls to properly constrain, observe, and govern their behaviors during execution. To secure autonomous development workflows, Docker Sandboxes allow AI agents to operate within GitHub Actions, run Testcontainers tests, adjust code, and automatically generate draft pull requests inside isolated environments. In addition, escalating software supply-chain threats and the increased volume of AI-generated code drive the adoption of Docker Hardened Images and Docker Extended Lifecycle Support. These updates incorporate software built from source into container images, extend security patch coverage past end-of-life milestones, and move organizational policy enforcement directly onto developer machines.

  Jin Kim

• Docker · Jul 20, 2026