What's Happening
Cybersecurity researchers at Xint.io and Theori have disclosed a high-severity Linux local privilege escalation (LPE) vulnerability tracked as CVE-2026-31431 (CVSS 7.8), codenamed Copy Fail.
The flaw originates from a logic error in the Linux kernel's cryptographic subsystem, specifically within the algif_aead module, introduced in a
source code commit from August 2017.
The root cause is an in-place optimization that allows a page cache page to end up in a kernel-writable destination scatterlist during an AEAD operation submitted over an AF_ALG socket. An unprivileged process can then use splice() to perform a small, targeted write into the page cache of a file it does not own.
In practice, a 732-byte Python exploit can corrupt a setuid binary such as /usr/bin/su and obtain root on virtually every Linux distribution shipped since 2017, including
Amazon Linux,
Debian,
Red Hat Enterprise Linux,
SUSE, and
Ubuntu.
All affected distributions have released advisories.
Copy Fail is in the same class as Dirty Pipe (CVE-2022-0847), which also allowed unprivileged users to overwrite page-cached read-only files. The key difference is the subsystem involved: Copy Fail lives in the crypto layer rather than the pipe layer.
Why Should You Care
Four properties make this vulnerability unusually dangerous, and they rarely appear together in a single finding:
- Portable. The same 732-byte exploit works across all major Linux distributions without modification.
- Tiny and stealthy. The exploit is minimal and leaves little forensic footprint.
- No race condition required. Exploitation is reliable and deterministic, not timing-dependent.
- Cross-container impact. Because the page cache is shared across all processes on a host, the vulnerability can be used to escape container boundaries, affecting multi-tenant and containerized environments.
The vulnerability is not remotely exploitable on its own; an attacker needs local access first. However, in environments where any untrusted local user exists, such as shared hosting, container platforms, CI/CD runners, or systems with compromised low-privilege accounts, Copy Fail provides a straightforward and reliable path to full root.
What Should You Do
Apply kernel patches from your distribution vendor as soon as they are available. All major affected distributions have published advisories linked above. Prioritize systems where untrusted local users can execute code, including shared compute, container hosts, and CI/CD infrastructure.
While patching is the only definitive fix, the following controls can reduce the window of exposure in the interim:
- Restrict AF_ALG socket access. Limiting unprivileged access to
AF_ALGsockets via seccomp profiles or AppArmor/SELinux policy blocks the specific exploit path without patching. - Audit local user accounts. Reduce the number of interactive and service accounts that have shell access on affected hosts.
- Harden container runtimes. Apply seccomp policies that restrict the
socket()andsplice()syscalls within containers to limit cross-container exploitation. - Monitor for setuid binary modification. File integrity monitoring on setuid binaries such as
/usr/bin/sucan provide detection signal even if exploitation occurs before patching.
Given the reliability and portability of the exploit, treat this as a high-urgency patch for any internet-facing or multi-user Linux system.