TL;DR: A Linux-kernel local privilege escalation (CVE-2026-31431, "Copy Fail") lets any pod — even an unprivileged, non-root container — gain root on your AKS Arc Linux nodes. Patch your Azure Local instance with the Support.AksArc remediation tool, then upgrade each AKS cluster to refresh the node images. The remediation cmdlet only exists in Support.AksArc 1.3.77 or newer, so confirm your module version before you run it.


Applies to: AKS enabled by Azure Arc workload cluster nodes (the node-pool VHDs) — not the Arc Resource Bridge appliance VM, which is serviced through its own update channel.


Recommended action:

  1. Get the correct Support.AksArc version onto the node. The fix cmdlet ships only in recent builds, and Update-Module installs a newer version side-by-side without changing which one Import-Moduleactually loads — so you can end up still running an old copy that lacks the cmdlet. Pin the version explicitly on both install and import:
    # Install at least the build that contains the fix, forcing over any older copy
Install-Module -Name Support.AksArc -MinimumVersion 1.3.77 -Force -AllowClobber

# Drop anything already loaded this session, then load a qualifying version explicitly
Remove-Module Support.AksArc -ErrorAction SilentlyContinue
Import-Module Support.AksArc -MinimumVersion 1.3.77 -Force

# Verify
(Get-Module Support.AksArc).Version          # must be 1.3.77 or higher
Get-Command Invoke-SupportAksArcRemediation_FixCVE_2026_31431 -ErrorAction SilentlyContinue
    If the last command returns nothing, an older module is still loaded — repeat the Remove-Module / Import-Module step.
  2. Update Azure Local if needed. If your deployment is on version 2601 or earlier, update to 2602 or later before continuing.
  3. Run the remediation on the Azure Local node. Run az loginon the node, then:
    Invoke-SupportAksArcRemediation_FixCVE_2026_31431
    Wait 10–15 minutes after it completes for the patched VHD images to download to your deployment.
  4. Upgrade each AKS cluster to refresh nodes with the patched VHDs, then verify with kubectl get nodes -o wide. For the target-version table and upgrade procedure, follow Step 3 of the Microsoft security bulletin (AKSARC-2026-0001) and Upgrade the Kubernetes version.


Why: The vulnerability is in the kernel's algif_aead module. It isn't loaded by default, but the kernel autoloads it on demand whenever any process creates an AF_ALG socket of AEAD type — which an unprivileged container can do with no special capabilities or host access. That means a foothold in any pod can escalate to root on the node. Patching the VHD images and refreshing the nodes removes the vulnerable path.


Going forward: Don't rely on Update-Module or the module's auto-import to give you the latest build before running any Support.AksArc remediation — pin the version on install and import, and verify with (Get-Module Support.AksArc).Version. Note that patching Azure Local alone doesn't fix existing nodes; they only pick up the fix after an AKS cluster upgrade. If you applied the interim mitigation below, remove it once you've confirmed the patched kernel is in place.


Optional details:

  • Severity: CVSS 3.1 score 7.8 (High), AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Local attack vector — requires code execution on the node, e.g. from a container.
  • Can't update right away? Apply the per-cluster self-service mitigation from the AKS advisory (Azure/AKS#5753), which blocks the vulnerable module from loading without an Azure Local update or cluster upgrade. Apply it to every existing cluster, and to any new cluster, until you complete the patch path above. Remove it after validating the kernel fix.
  • References: Support Tool docs · CVE-2026-31431 · Canonical advisory