# Flashbox Incident Report: April 30, 2026

**URL:** https://collective.flashbots.net/t/flashbox-incident-report-april-30-2026/5686
**Category:** The Flashbots Ship
**Tags:** post-mortem, flashbox
**Created:** [April 30, 2026, 3:39pm UTC](https://collective.flashbots.net/t/flashbox-incident-report-april-30-2026/5686 "2026-04-30T15:39:55Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![Moe](https://collective.flashbots.net/letter_avatar_proxy/v4/letter/m/ad7895/32.png) [@Moe](https://collective.flashbots.net/u/Moe)
#### Post date: [April 30, 2026, 3:39pm UTC](https://collective.flashbots.net/t/flashbox-incident-report-april-30-2026/5686/1 "2026-04-30T15:39:55Z")

</div>

## What happened

On April 30 we identified that Flashbox images built before that date were running an unpatched Linux kernel affected by CVE-2026-31431 ([copy.fail](https://copy.fail/)), publicly disclosed the day before. As a precaution, we paused orderflow streaming to production Flashboxes while we scoped the impact and communicated the change to Flashbox searchers. We then shipped a kernel bump that includes the upstream fix and rebuilt the images. Orderflow streaming resumed once searchers migrated to the rebuilt image.

## Root Cause

CVE-2026-31431 ([copy.fail](https://copy.fail/)) was publicly disclosed on April 29. The bug is in the Linux kernel’s `algif_aead` interface: an unprivileged user who can call `socket(AF_ALG, SOCK_SEQPACKET, 0)` and `splice()` can write 4 bytes into any page-cache page of a file they can read, via the `authencesn` AEAD’s ESN rearrangement. Flashbox was running an unpatched Debian 6.18 kernel with `CONFIG_CRYPTO_USER_API_AEAD=y`, which exposes that entry point.

In simpler terms: this class of bug lets a process running as an unprivileged local user, including one inside a container, escalate to root on the host, which would effectively be a container escape with full system access.

## Timeline (UTC)

- **April 29** - CVE-2026-31431 disclosed ([xint.io](https://xint.io/), copy.fail, oss-security).
- **April 30, ~08:00** - Internal investigation of impact on Flashbox begins. Orderflow streaming to production Flashboxes paused as a precaution; change communicated to Flashbox searchers.
- **April 30, ~09:30** - Investigation continues; no exploitation observed on the deployed image.
- **April 30, ~10:30** - Fix scoped: kernel bump to Debian’s 6.19 backport.
- **April 30, ~11:30** - [PR #138](https://github.com/flashbots/flashbots-images/pull/138) merged (`KERNEL_VERSION=6.18`→`6.19`, snapshot `20260301T083349Z`→`20260430T025253Z`).
- **April 30, ~13:00** - Rebuilt images deployed. Flashbox searchers migrated to the rebuilt image. Functional testing passed. Orderflow streaming resumed.

## Impact

- All Flashbox images built before April 30 carry an unpatched kernel exposing the copy.fail primitive.
- No exploitation observed.
- Orderflow streaming to production Flashboxes was paused for the duration of the response.
- Flashbox searchers were migrated to the rebuilt image.

## Resolution

[PR #138](https://github.com/flashbots/flashbots-images/pull/138) bumps `KERNEL_VERSION` to 6.19 and the Debian snapshot to `20260430T025253Z`. That pulls `linux-source-6.19_6.19.13-1~bpo13+1` from trixie-backports, whose changelog carries the upstream fix `a664bf3d603d` (“crypto: algif\_aead - Revert to operating out-of-place”) and its `authencesn` follow-up. Distribution remains Debian trixie; only the kernel package source moved to the 6.19 line that already includes the fix.

## Lessons Learned

**What went well**

- Layered defenses already in place on the image (mount-namespace boundary, restricted `searchersh` shell, narrow sudo allow-list, RAM-backed rootfs) provided defense in depth alongside the unpatched kernel.
- Pausing orderflow streaming during the response window kept Flashbox searchers informed and limited exposure while the fix was prepared.
- Within 3-4 hours we triaged, fixed, merged, rebuilt and resumed Flashbox operations normally again.

**What we’re improving**

- The searcher container already runs under a custom seccomp profile. We are extending it to explicitly block the `AF_ALG` socket family, the entry point used by this attack class, as a follow-up.
- Beyond this fix, we are continuing to invest in kernel- and image-level hardening as part of ongoing security work.