getroot — AF_ALG page-cache LPE and container escape

getroot is the escalation stage of the rootpacket toolkit, recovered from a Docker API intrusion. It exploits CVE-2026-31431, a use-after-free in the Linux kernel’s AF_ALG page-cache handling. A local, unprivileged process reaches the freed object through the crypto user-API socket family, reclaims it, and steers a controlled write into kernel memory to escalate to root.

Because the primitive operates on the host kernel rather than anything namespaced, the same run that lands root inside a container reaches the host: a privileged or loosely-confined container becomes a full host compromise. In the captured campaign that was the whole point. getroot handed off to an intel_uncore_freq_aux LKM rootkit that faked CPU and memory, rebuilt itself through DKMS across reboots, and hid a UPX-packed XMRig miner. The exploit is the interesting part; what it escalated into was ordinary cryptojacking.

Detection favours the escalation, not the trigger. Watch for AF_ALG socket use from workloads that have no reason to touch the kernel crypto API, unexpected DKMS builds, and out-of-tree modules with vendor-adjacent names such as intel_uncore_freq_aux. The fix is the upstream kernel patch; where you cannot patch promptly, disabling AF_ALG or restricting it removes the vector. The working PoC is public in the linked repo, mirrored from the rootpacket sample; run it only in a disposable VM.