Linux Kernel 0‑Day “Copy Fail” (CVE‑2026‑31431)

 

What is “Copy Fail”?

Copy Fail is a high‑severity Linux kernel local privilege‑escalation (LPE) zero‑day vulnerability disclosed publicly on April 29–30, 2026 and tracked as CVE‑2026‑31431. ]

It allows any unprivileged local user to gain full root access on essentially every major Linux distribution released since 2017, using a tiny (≈732‑byte) Python exploit that works unchanged across distributions.

---

Root Cause (Technical Summary)

The bug is a logic flaw, not a race condition.

It lives in the Linux kernel’s cryptographic userspace API—specifically:

• algif_aead.c
• the AEAD (Authenticated Encryption with Associated Data) socket interface (AF_ALG)
• the authencesn crypto template

A 2017 optimization allowed kernel operations to run in place on page‑cache memory. When combined with:

• an AF_ALG socket
• the splice() system call

…the kernel can be manipulated into performing a controlled 4‑byte write directly into page‑cache memory belonging to any readable file. 

Because page cache is what the kernel uses when executing binaries, modifying it is effectively the same as modifying the file—without touching disk.

---

Why This Is Dangerous

Copy Fail is considered unusually serious for several reasons:

 No race condition

Unlike Dirty COW or Dirty Pipe, this exploit is deterministic and reliable every run.  

 Tiny, portable exploit

A short Python script works on:

• Ubuntu
• RHEL / Rocky / Alma
• Amazon Linux
• SUSE
• Debian, Fedora, Arch (implicitly affected)

No kernel offsets, no recompiling, no tuning required. 

 Stealthy (no disk changes)

Only RAM page cache is altered:

• The on‑disk binary remains unchanged
• File integrity monitoring, hashes, and forensic disk scans show nothing.  

 Container escape primitive

Page cache is shared across the host kernel, meaning:

• A compromised container can modify cached setuid binaries
• This can break out into the host or other containers
  This is critical for Kubernetes, CI runners, and multi‑tenant systems.

---

What an Attack Looks Like (High Level)

1. Attacker has any local code execution (user account, CI job, compromised service).
2. Uses an AF_ALG socket and splice() to trigger the flaw.
3. Writes 4 bytes into the cached memory of a setuid binary (e.g. /usr/bin/su).
4. Executes the binary → gains root shell.
5. Reboot clears evidence.

---

Affected Systems

• All Linux kernels built since 2017 (≈ kernel 4.14+)
• All major distros unless explicitly patched.

Notably affected:

• Ubuntu 20.04–24.04
• Amazon Linux 2023
• RHEL / Rocky / Alma / Oracle
• SUSE
• Debian / Fedora / Arch

---

Patch & Mitigation Status (as of Apr 30, 2026)

• Upstream fix committed: April 1, 2026
  (Reverts the unsafe 2017 optimization)
• Vendor patches: Rolling out; availability varies by distro
• Public PoC: Available

Interim mitigations (if you cannot patch immediately):

• Restrict or audit AF_ALG socket usage
• Limit execution of untrusted code
• Prioritize patching:
  1. Kubernetes nodes
  2. CI/CD runners
  3. Multi‑tenant systems

---

Why Security Professionals Are Alarmed

Bugcrowd and others note that Copy Fail combines properties that rarely appear together:

• Universal
• Reliable
• Small
• Cross‑container
• Stealthy

This is the type of primitive that historically sold for six figures on exploit markets.

---

Bottom Line

Copy Fail is one of the most severe Linux local privilege‑escalation vulnerabilities ever disclosed.
If an attacker can run anything as a normal user, they can become root—quietly and reliably.

Patch immediately when vendor updates become available, and treat untrusted workloads as high risk until then.

If you want, I can:

• Check your distro’s patch status
• Explain detection options
• Map this to CIS / compliance impact
• Break down exploit mechanics in more depth