Critical Linux "Copy Fail" Vulnerability Grants Root Access Across Major Distributions

Key Findings

• CVE-2026-31431 (Copy Fail) is a 9-year-old Linux kernel vulnerability enabling unprivileged users to gain root access

• A 732-byte Python script can exploit the flaw to modify setuid binaries in memory and achieve root privileges

• The vulnerability affects all major Linux distributions since 2017, including Ubuntu, RHEL, Amazon Linux, SUSE, and Debian

• Exploitation is reliable and portable across distributions with no race conditions required

• The flaw exists in the algif_aead module within the kernel's cryptographic subsystem due to a 2017 optimization change

• Attacks leave minimal forensic traces since modifications occur in page cache memory rather than on disk

• Cross-container impacts exist as the page cache is shared across all processes on a system

Background

Security researchers at Xint.io and Theori discovered Copy Fail using AI-powered code auditing tools after identifying an initial lead. The vulnerability stems from a logic flaw introduced in August 2017 when the Linux kernel underwent an in-place optimization in the algif_aead module. Despite being publicly unknown until now, the bug has existed for nearly a decade across billions of Linux systems worldwide.

Technical Details of the Vulnerability

The flaw occurs in how the authencesn tool handles AEAD (Authenticated Encryption with Associated Data) algorithms for cryptographic operations. When organizing data for network security tasks, the tool accidentally writes four controlled bytes into the wrong memory location. Due to the 2017 optimization change, these bytes end up in the page cache of sensitive files like /usr/bin/su, which runs with elevated privileges.

The page cache is a system memory component that stores file fragments for quick access without repeatedly checking storage drives. This design normally improves performance but becomes a security liability when corrupted by this vulnerability.

Exploitation Method

The attack follows a straightforward four-step process. First, an unprivileged user opens an AF_ALG socket and binds it to authencesn(hmac(sha256),cbc(aes)). Second, they construct shellcode payload. Third, they trigger a write operation using splice() that targets the kernel's cached copy of /usr/bin/su. Finally, they call execve() to load the injected shellcode and execute it as root.

What makes this particularly dangerous is that the exploit works every single time without requiring race conditions or knowledge of kernel memory offsets. The same 732-byte Python script functions identically across Ubuntu 24.04 LTS, Amazon Linux 2023, Red Hat Enterprise Linux 10.1, and SUSE 16.

Why Detection Has Been Impossible

File integrity monitoring tools designed to catch unauthorized modifications have consistently missed this vulnerability because changes occur in memory rather than on disk. The actual files remain untouched on storage, leaving no traditional forensic evidence. This stealthy nature allowed the bug to persist undetected for nearly a decade.

Similarities to Previous Vulnerabilities

Copy Fail echoes Dirty Pipe (CVE-2022-0847), another Linux kernel LPE that allowed unprivileged users to splice data into the page cache of read-only files. According to Bugcrowd's Chief AI and Science Officer David Brumley, Copy Fail represents the same class of vulnerability operating in a different kernel subsystem. Both attack the page cache but through different entry points.

Security Implications

The vulnerability is uniquely dangerous because it combines four rarely simultaneous properties: portability across distributions, tiny exploit code, stealthy execution, and cross-container impact. Any user account, regardless of privilege level, can escalate to full administrative access. In shared hosting environments, an attacker in one container can corrupt the page cache affecting the host and all other tenants.

Brumley emphasized that if described to top kernel researchers, such a bug would historically command prices comparable to expensive real estate on vulnerability broker markets. The combination of reliability, simplicity, and universal applicability makes it extraordinarily valuable from a threat perspective.

Distribution Response and Remediation

Linux distributions have released their own advisories and patches in response to the disclosure. The official fix changes how the system handles data, replacing the risky in-place method with a safe copy operation in a separate memory area, preventing accidental overwrites.

Users are urged to update to the latest kernel patch, specifically commit a664bf3d603d. For those unable to patch immediately, disabling the algif_aead module blocks the exploitation path without affecting common applications like web browsers or SSH functionality.

Broader Security Implications

The discovery signals a significant shift in cybersecurity economics. The assumption that finding kernel-grade bugs requires expensive resources and sophisticated tools now appears outdated. AI-powered code analysis platforms have potentially reduced the cost of discovering deep logic flaws by an order of magnitude, raising concerns about both defensive and offensive security landscapes moving forward.

Sources

• https://thehackernews.com/2026/04/new-linux-copy-fail-vulnerability.html

• https://hackread.com/linux-kernel-vulnerability-copy-fail-full-root-access/

• https://cybersecuritynews.com/linux-kernel-0-day-copy-fail/

• https://x.com/The_Cyber_News/status/2049680446657798402