A critical vulnerability in the Linux kernel allows any unprivileged local user to gain root privileges using a simple 732-byte script. This affects all major Linux distributions deployed since 2017, including systems you may be running. Immediate patching is required.
Description
CVE-2026-31431, branded "Copy Fail," is a logic flaw in the Linux kernel's cryptographic subsystem. The vulnerability allows an unprivileged local user to write 4 bytes into the memory cache of any readable file on the system. By targeting setuid binaries like /usr/bin/su, an attacker can inject malicious code and execute it with root privileges.
The vulnerability exists in the authencesn cryptographic template when combined with the AF_ALG socket interface and the splice() system call. When these components interact, the kernel incorrectly allows write operations into memory pages that should be read-only, corrupting the cached version of system files.
What makes this vulnerability particularly dangerous is that the corruption only affects the in-memory cache, the actual files on disk remain unchanged. This means standard file integrity monitoring tools that check disk-based checksums will not detect the compromise.
The same vulnerability also crosses container boundaries because all containers on a system share the same kernel memory cache. This makes it both a privilege escalation vulnerability and a container escape mechanism.
Impact
We estimate the impact of this vulnerability as high.
If exploited, an attacker with basic user access to any Linux system can:
- Gain complete root (administrator) access to the system
- Execute arbitrary commands with full system privileges
- Install persistent backdoors or malware
- Access, modify, or delete any data on the system
- Escape from containers to compromise the underlying host system
- Pivot to other systems on the network using elevated privileges
The vulnerability affects virtually all Linux distributions shipped since 2017, including:
- Ubuntu
- Red Hat Enterprise Linux / CentOS / Rocky Linux
- Amazon Linux
- SUSE Linux Enterprise
- Debian
Both physical servers and cloud instances are vulnerable. Container platforms like Docker and Kubernetes are particularly at risk due to the container escape capability.
Risk
We estimate the risk of this vulnerability as high.
The risk is exceptionally high because:
Exploitation is trivial: A working exploit requiring only 732 bytes of Python code is publicly available. The exploit works reliably without requiring any complex timing, race conditions, or multiple attempts. It works identically across all tested Linux distributions without modification.
Attack prerequisites are minimal: Any user account on a vulnerable Linux system can exploit this, including:
- Low-privilege service accounts
- Compromised web application users
- Users who gained initial access through phishing or other means
The vulnerability is widespread: Nearly every Linux system deployed in the last 9 years is affected. This includes web servers, database servers, container hosts, cloud instances, and development environments.
Detection is difficult: Because the attack modifies only in-memory data and leaves disk files unchanged, traditional file integrity monitoring will not detect the compromise. The attack also operates through legitimate kernel interfaces, making it harder to distinguish from normal system activity.
Active exploitation is expected: Given the public availability of exploit code and the universal nature of the vulnerability, widespread exploitation attempts are inevitable and likely already underway.
Mitigation
Primary mitigation - Apply kernel updates immediately:
All major Linux distributions have released or are releasing patched kernel versions. Update your systems using your distribution's standard package manager.
After updating, reboot your systems to activate the new kernel.
Temporary workaround (if immediate patching is not possible):
If you cannot immediately patch, you can temporarily block the vulnerable code path by preventing the algif_aead kernel module from loading:
bash echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif-
Important: This workaround may break IPsec VPN functionality or other software that uses kernel-based cryptography. Test in your environment and plan for proper patching as soon as possible.
What should you do?
Immediate actions (today):
1. Identify all Linux systems in your environment, including:- Physical and virtual servers
- Cloud instances (AWS, Azure, GCP)
- Container host systems running Docker or Kubernetes
- Development and test environments
- External-facing Linux systems (web servers, VPN endpoints, bastion hosts)
- Container host systems and Kubernetes nodes
- Multi-tenant systems where multiple users have accounts
- Internal production servers
- Development and test systems
4. Schedule maintenance windows to reboot systems and activate the patched kernels
5. For systems that cannot be immediately patched, apply the temporary workaround to block the vulnerable module
Within 7 days:
6. Verify all systems are patched by checking kernel versions include the fix (commit a664bf3d603d)7. Review security logs for unusual activity around the time of public disclosure (April 29, 2026 onward), particularly:
- Unexpected privilege escalations
- Unusual activity from low-privilege accounts
- Unexpected modifications to setuid binaries
- Container escape attempts
Ongoing:
9.Maintain regular kernel patching schedules to prevent similar exposure windows in the future10. Consider implementing additional security controls such as:
- SELinux or AppArmor mandatory access controls
- Container security policies that limit system call access
- Enhanced monitoring for privilege escalation attempts
What will Northwave do?
Vulnerability Management customers will be informed in case vulnerable systems are detected in their infrastructure.
We will monitor any developments regarding this vulnerability. If new critical information about this threat arises we will reach out to you. You can call us by phone or send us an email if you would like additional information.
Phone number: +31 (0)30-303 1244 (during business hours)
E-mail: soc@northwave-cybersecurity.
Do you have an incident right now? Call our Incident Response Team: 00800 1744 0000
Disclaimer applies, see below.
Sources
- Xint Code Research Advisory: https://xint.io/blog/copy-
fail-linux-distributions - Linux Kernel Fix: https://github.com/torvalds/
linux/commit/ a664bf3d603dc3bdcf9ae47cc21e0d aec706d7a5 - CVE Entry: CVE-2026-31431