AI Agent Uncovers Linux Kernel Zero
6 Min. Read Time
A KI agent from Theori autonomously discovered CVE-2026-31431 on 04.05.2026 in under an hour, developed a functional exploit, and published a public webpage about it. CrowdStrike confirms active exploitation in the wild. CISA has added the vulnerability to the Known Exploited Vulnerabilities (KEV) list. Affected systems: all Linux distributions with kernel from 2017 onwards.
Key Takeaways
- CISA KEV confirmed, active exploitation. CrowdStrike has confirmed wild exploitation of CVE-2026-31431. Patching is mandatory for all Linux systems, no exceptions.
- AI discovery as a new threat class. Theori’s Autonomous Agent found the vulnerability in ~60 minutes. Vulnerability research via AI now scales differently than before.
- Locally exploitable, but genuinely dangerous. No remote exploit – an SSH foothold is enough. Privilege escalation on affected systems is trivial thereafter.
Related:CVE-2026-32202: Windows patch incomplete / DSGVO fine 2026: Fine practice for SMEs
What’s behind CVE-2026-31431 technically
What is CVE-2026-31431? CVE-2026-31431 is a Linux kernel privilege escalation vulnerability in the AF_ALG interface (Application Framework – Algorithm). A local attacker with shell access can gain kernel privileges through a controlled memory error. The vulnerability affects all Linux distributions with kernel from 2017 onwards and has been listed on CISA KEV since 04.05.2026.
The bug – internally called “copyfail” – combines a flaw in the ONC ESN component with a page-cache write primitive. Attackers can trigger a controlled memory error via the AF_ALG interface, escalating kernel privileges.
The public proof-of-concept by Theori is 732 lines of Python. It works on all Linux distributions that have loaded the AF_ALG module since the kernel update in 2017 – including Debian, Ubuntu, Arch, Red Hat, SUSE, and their derivatives. A system without this module is not vulnerable, but the majority of all Linux deployments in cloud environments have AF_ALG loaded.
Why the AI discovery method is relevant
Theori didn’t just build a scanner. The autonomous agent analyzed the kernel code, identified the vulnerability class, developed an exploit, and published the results – all without a human review step in the core process. This took around one hour.
This has two implications for DACH security teams. First, the time between vulnerability emergence and public exploit is getting shorter. If an AI agent can analyze kernel code for exploitable patterns in 60 minutes, the patch window for zero-days shrinks structurally. Second, attackers are using the same techniques. Gray-market estimates for comparable Linux local privilege escalation exploits range between $10,000 USD and $7 million USD according to Crowdfence pricing – the market exists.
“Active exploitation in the wild confirmed. All unpatched Linux systems with AF_ALG enabled are at risk.”
CrowdStrike Threat Intelligence, 04.05.2026
Patch status and immediate measures
The CISA KEV listing means a patch deadline for US federal agencies. For DACH organizations, this is not a binding obligation, but a signal: exploitation is confirmed, the exploit is public, and the risk is real.
Patch status of major distributions (as of 05.05.2026): Red Hat Enterprise Linux and CentOS Stream have updates in the advisory channel. Debian Stable and Ubuntu LTS have patches in staging. Arch and SUSE/openSUSE are following. Details can be found on the respective security mailing lists of the distributions.
Systems without immediate patching capability can disable the AF_ALG module: echo “install af_alg /bin/false” >> /etc/modprobe.d/blacklist.conf. This prevents the exploit but restricts crypto operations that use AF_ALG. Check which applications are affected before implementing the workaround in production.
Frequently Asked Questions
Every question is locked. A tap unlocks the answer.
Is CVE-2026-31431 remotely exploitable?
No. The exploit requires a local session or an SSH foothold. An attacker must already have access to the system. Remote code execution over the network is not possible with this CVE alone. This doesn’t change the urgency: SSH access with weak credentials or leaked keys is often the first step in cloud environments.
Which Linux versions are affected?
All distributions that load the AF_ALG kernel module and use a kernel from the 2017 merge commit series onwards. This affects de facto all modern Linux systems: Debian Stable, Ubuntu LTS, Red Hat Enterprise Linux, CentOS, Arch, SUSE/openSUSE, Alpine. Kernel changelogs show versions from 4.14 onwards as vulnerable.
What does the CISA KEV listing mean for European organizations?
Direct legal binding: none. The KEV list applies to US federal agencies. Practical significance: considerable. A KEV listing indicates active exploitation – European organizations subject to NIS2 already have a patch obligation for critical security vulnerabilities. Those with NIS2 reporting obligations should prioritize CVE-2026-31431 and document internally when patched.
How quickly must we patch?
Immediately where possible. CISA KEV implies active exploitation – the exploit is public, and CrowdStrike has confirmed attacks. Systems with SSH access and without a patch are a calculable risk. Internal deadline: 48 hours for productive Linux systems with network access, 7 days for isolated systems with restricted access.
What is the AF_ALG workaround and what are its drawbacks?
AF_ALG (Application Framework – Algorithm) is the kernel interface for crypto operations. Disabling it via blacklist prevents the exploit, but applications that use AF_ALG – certain TLS implementations, disk encryption layers, HSM connections – lose their kernel crypto acceleration or fall back to user-space fallbacks. Performance losses are possible. Test before production.
More from the MBF Media Network
Source title image: Pexels / Markus Spiske
