A newly disclosed exploit targets a vulnerability in the Linux kernel’s AF_ALG interface, affecting versions 5.4 through 6.8. The flaw allows a local user to escalate privileges to root.
The attack exploits the algif_aead kernel module. By using splice() combined with the AEAD crypto interface, an attacker can overwrite arbitrary files in the page cache. The proof-of-concept overwrites /usr/bin/su in memory and spawns a root shell.
Requirements are minimal: an unprivileged local account and the algif_aead module loaded. The exploit was tested successfully on Ubuntu 22.04 and Debian 12.
The vulnerability was disclosed on April 30, 2026, with exploit author Long Fong Chan publishing the PoC. No CVE identifier has been assigned yet, but the exploit is publicly available.
System administrators should restrict access to the AF_ALG interface and consider disabling the algif_aead module where it isn’t needed. Patching to a kernel version beyond 6.8 is the definitive fix.
