The vulnerability stems from an optimization in the Linux kernel's VFS layer. When copying data between files, the kernel attempts to perform a 'splice' or a page-level copy to save cycles. In CVE-2026-31431, an attacker can use a shared memory file as the source. Because the kernel trusts the source's page cache, it maps those pages into the destination's cache without properly marking them for writeback. This means a process reading the destination file will see the attacker's 'poisoned' data from the cache, even though the file on disk remains unchanged. This is the 'Paradox': the file is both compromised and 'intact' simultaneously.
ssize_t copy_file_range(int fd_in, loff_t *off_in, int fd_out, loff_t *off_out, size_t len, unsigned int flags);
// Logic Flaw: The kernel fails to invalidate the page cache of fd_out
// if fd_in is a memory-backed file (shm) and fd_out is a disk-backed file.
// Result: The page cache for fd_out is updated with fd_in's data,
// but the change is not immediately written to disk or flagged as 'dirty'.
Mitigation requires a kernel-level fix that forces a cache invalidation and integrity check when copy_file_range is called across different filesystem types or memory-backing boundaries. EDRs can detect this by monitoring for unusual syscall patterns involving shm and sensitive system binaries.