Skrevet av:

 

Background

Copy Fail (CVE-2026-31431) is a severe Linux kernel vulnerability that enables a local user to gain privileged access to a system, with a severity rating of 7.8 out of 10. In simple terms, it breaks a core safety boundary in Linux by allowing users to modify the page cache of protected files in a controlled way. This could be used to tamper with important system files and ultimately become root, resulting in complete takeover of the system. The issue has existed for years across many Linux distributions, making it widely relevant for both servers and desktops.

The impact is high because exploitation does not require special privileges and can be performed locally by any user who already has limited access. The recommended mitigation is to apply relevant security updates from your Linux distribution as soon as they are available. In addition, limiting untrusted user access, using container isolation carefully, and monitoring for unusual activity can help reduce risk until systems are updated.

Threat Intelligence assessment

The vulnerability is assessed to have a very high likelihood of real-world exploitation. Public proof-of-concept (PoC) code was released at the time of disclosure (April 29, 2026), and multiple working exploits are already available. These exploits automate the full attack chain, including modifying sensitive system files like /etc/passwd to give the attacker root privileges, and then spawning a root shell. What makes this vulnerability especially dangerous is how simple and reliable the exploitation is. There are no race conditions, no need for timing precision, and no system-specific adjustments. The same short script works consistently across major Linux distributions such as Ubuntu, RHEL, Amazon Linux, and SUSE.

Although Copy Fail is not a remote code execution (RCE) vulnerability by itself, it only requires a standard, unprivileged user account to succeed. Once an attacker has any form of local access such as a compromised user account, a foothold in a container, or access via another vulnerability, they can escalate privileges to full root almost instantly. The exploit itself is small (around 700 bytes) and requires no special tools, kernel knowledge, or debugging capabilities. It relies entirely on normal kernel functionality, which also makes detection difficult. Because it does not introduce obvious malicious binaries or unusual behaviour, traditional security tools may struggle to identify exploitation.

The vulnerability originates from a logic flaw introduced in 2017 as part of a performance optimisation in the Linux kernel’s cryptographic subsystem (algif_aead). This means that the issue has been present and widely deployed for nearly a decade, affecting a vast number of systems across servers, cloud environments, and desktops. Its exposure is therefore broad, and any unpatched system running a vulnerable kernel post-disclosure should be considered at risk.

From a risk perspective, Copy Fail is rated severe due to its ability to provide full root compromise. Its exploitability is easy and highly reliable, requiring minimal skill or effort, which also makes it accessible to low-skilled attackers. At the same time, detection is complicated by the fact that it leverages legitimate kernel features and leaves minimal traces. Overall, this combination of wide exposure, ease of exploitation, and low visibility makes Copy Fail one of the more serious Linux privilege escalation vulnerabilities in recent years, requiring urgent patching and mitigation.

Recommendations

It is recommended to:

Detection and hardening

  • Consider running a vulnerability scanner to identify vulnerable devices, as described by Tenable.
  • Harden container environments (reduce shared kernel exposure) as recommended by the Juliet Security Team.
  • Monitor for:
    • unexpected privilege escalation from non-root users (e.g. sudo, su)
    • changes to sensitive files such as /etc/passwd and /etc/shadow
    • unprivileged processes spawning root shells, modifying system binaries
    • processes interacting with AF_ALG (socket system call run by a non-root user: UID 0)
  • Deploy EDR or eBPF-based tools to detect abnormal kernel interactions