Linux Kernel 0-Day “Copy Fail” Grants Root Access Across Major Distros Since 2017

Security researchers have disclosed a critical zero-day vulnerability in the Linux kernel dubbed “Copy Fail” (CVE-2026-31431), which allows unprivileged local users to gain root access.

Using a tiny 732-byte Python script, attackers can exploit a logic flaw present in major Linux distributions released since 2017.

Copy Fail is a local privilege escalation (LPE) vulnerability found in the Linux kernel’s cryptographic subsystem. Unlike older notorious bugs like Dirty Cow, which relied on race conditions and often crashed systems, Copy Fail is a deterministic logic flaw.

It requires no retries or specific timing windows, making it highly reliable and portable across different architectures.

The exploit is highly stealthy because it alters the in-memory page cache of a file rather than modifying the file on the physical disk.

The kernel’s writeback machinery never marks the corrupted page as dirty, meaning standard file integrity monitoring tools that check on-disk checksums will fail to detect the modification.

How the Exploit Works

The root cause of Copy Fail lies in a combination of three kernel features: the AF_ALG socket type, the splice system call, and the authentication cryptographic template.

The AF_ALG interface exposes the kernel’s cryptographic functions to unprivileged users. When an attacker uses a splice command to transfer file data into an AF_ALG socket, the system directly references the kernel’s cached pages of that file.

A 2017 kernel optimization allowed cryptographic operations to happen in-place, meaning the same memory space was used for both input and output.

The authencesn algorithm inadvertently uses this output boundary as a temporary scratch pad, writing 4 bytes past the intended limit.

This allows an attacker to execute a controlled four-byte overwrite into the page cache of any readable file, such as the setuid-root binary for user switching. By injecting shellcode into this cached executable, the attacker gains root privileges immediately.

This vulnerability affects major Linux distributions, including Ubuntu, Amazon Linux, Red Hat Enterprise Linux (RHEL), and SUSE. Because the page cache is shared system-wide, the flaw is not limited to local privilege escalation on a single machine.

It also serves as a container escape primitive, meaning an attacker could potentially compromise an entire Kubernetes node by crossing container boundaries.

The bug was introduced in kernel version 4.14 and remained undetected for nearly a decade until an AI-assisted review by Theori and Xint Code researchers uncovered it.

Linux kernel developers have released patches to address CVE-2026-31431 in versions 6.18.22, 6.19.12, and 7.0.

The fix simply removes the flawed in-place operation mechanism, reverting to safer out-of-place handling where source and destination memory mappings are kept separate. System administrators should update their kernels immediately.

If patching is not immediately possible, users can apply a temporary mitigation by blocking the vulnerable module.

This is done by adding an install rule for algif_aead to route to /bin/false within the modprobe configuration directory, and subsequently removing the active algif_aead module from the running system.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.