Cloudanix VulnDB

GHSA-m38g-vww2-mvgx

High · 7.5

Talos Linux has a local privilege escalation from untrusted workloads

CVSS

7.5

EPSS

—

Published

May 7, 2026

CISA due date

—

The record

A vulnerability in the Linux kernel's algif_aead subsystem (CVE-2026-31431, "copy.fail") allows an unprivileged container workload to corrupt arbitrary file page-cache pages via the AF_ALG crypto interface and splice(). On Talos Linux, this vulnerability can be chained into a complete node compromise: an attacker who can schedule a pod on a worker node can, without any elevated Kubernetes permissions, achieve arbitrary code execution as root on the host (by poisoning a binary inside a privileged pod, or poisoning a binary which runs with elevated privileges like a CNI binary), access host filesystem, including node secrets. The exploit does not require kernel debugging, race conditions, or any prior privileges beyond the ability to create a pod.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities