On April 29, 2026, security teams across the world scrambled to patch Linux systems after the public disclosure of CVE-2026-31431, a vulnerability now widely known as “Copy Fail.” This flaw, discovered by Xint Code and publicly disclosed by Theori, allows any local user to escalate privileges to root on virtually every mainstream Linux distribution released since 2017. The exploit is so reliable that a 732-byte Python script, using only the standard library, is sufficient to compromise Ubuntu, Amazon Linux, RHEL, and SUSE in a matter of seconds (copy.fail, Xint Code Research).
The flaw’s most unsettling aspect is its straight-line reliability: there is no need for race conditions or brute force. It works out-of-the-box, crossing container boundaries and bypassing most monitoring solutions by corrupting the in-memory page cache instead of writing to disk. For defenders, the timeline from disclosure to public proof-of-concept was measured in hours, not days, underscoring how automation and AI-accelerated security research are compressing the response window for critical bugs.
Security teams are under pressure to patch and detect privilege escalation attempts as Copy Fail is weaponized in the wild.
Technical Root Cause: How CVE-2026-31431 Enables Straight-Line Privilege Escalation
The vulnerability exists in the Linux kernel’s cryptographic subsystem, specifically in the handling of in-place Authenticated Encryption with Associated Data (AEAD) decryption using the authencesn template over the AF_ALG interface. The chain of mistakes that led to this bug includes a 2017 optimization allowing in-place AEAD decryption, which, when combined with the splice() syscall, permitted direct references to page cache pages within a writable scatterlist.
When a user splices a file into a pipe and then into an AF_ALG socket, the kernel creates a scatterlist pointing directly to the page cache pages of the file. During AEAD decryption, the authencesn algorithm (used by IPsec for Extended Sequence Numbers) uses the destination buffer as scratch space and writes four bytes past the intended output region. If this destination buffer includes page cache pages from a setuid binary (like /usr/bin/su), the kernel writes attacker-controlled bytes directly into the in-memory cache of that binary.
The attack does not alter the file on disk, the kernel never marks the page dirty, so file integrity scanners comparing on-disk checksums will miss the change. Execution of the binary loads the corrupted in-memory version, enabling arbitrary code execution as root.
Example Code: What Exploitation Looks Like (Python Pseudocode)
# WARNING: This is a simplified demonstration for educational purposes only.
# Do NOT run this on production systems.
import socket
import os
def exploit_copy_fail(target_file, payload_bytes):
algfd = socket.socket(socket.AF_ALG, socket.SOCK_SEQPACKET, 0)
algfd.bind(('aead', 'authencesn(hmac(sha256),cbc(aes))'))
# Set key, accept request socket, and prepare AAD and ciphertext as per PoC
# Use os.splice to move file pages and trigger the vulnerable code path
# Real exploits must handle offsets, AEAD parameters, and shellcode placement
os.system(f"python3 copy_fail_exp.py {target_file}")
# Attempt to overwrite /usr/bin/su's page cache for privilege escalation
exploit_copy_fail('/usr/bin/su', b'ABCD')
# Note: For a working exploit, see the official PoC at https://github.com/rootsecdev/cve_2026_31431
Real-World Attack Scenarios and Detection Approaches
Copy Fail is not limited to academic privilege escalation. Its primitive of in-memory page cache corruption is portable and stealthy, with cross-container and multi-tenant implications.
Cloud providers and SaaS vendors must treat every untrusted tenant as a potential root user until all kernels are patched.
Multi-tenant Linux hosts: Any unprivileged user on a shared developer box, jump host, or build server can become root. This is especially dangerous for CI runners (e.g., GitHub Actions, GitLab, Jenkins) that execute untrusted code.
Kubernetes/container clusters: The shared page cache allows a single compromised pod to overwrite binaries and escalate privileges node-wide, bypassing container isolation.
Cloud SaaS and serverless: Any service running user-supplied code in a container or sandbox is at risk of host compromise.
Single-user laptops/workstations: While less exposed, the bug can be chained with remote code execution (RCE) or credential theft for complete device takeover.
Detection and Monitoring Approaches
Traditional file integrity monitoring will NOT catch this attack because the on-disk file remains unchanged. Instead, defenders must combine multiple strategies:
System call auditing: Use auditd or strace to monitor suspicious AF_ALG socket activity and splice() calls.
Kernel memory tracing: Employ ftrace, eBPF, or Kprobes to watch for abnormal buffer writes and page cache manipulation in real time.
File integrity monitoring: Use AIDE or OSSEC to detect changes to setuid binaries (but note: these tools must be extended to check in-memory state, not just on-disk hashes).
Enhanced kernel logging: Increase logging verbosity for cryptographic API events and page cache operations.
The only true remediation is to patch the kernel. The fix, merged as commit a664bf3d603d, reverts the risky in-place optimization so that the vulnerable scatterlist path is no longer reachable.
Major distributions, including Ubuntu, RHEL, SUSE, and Amazon Linux, have already shipped updates. To check your system:
This breaks only specific user-space crypto setups. Most workloads (dm-crypt, LUKS, kTLS, IPsec, OpenSSL, SSH) are unaffected.
Block AF_ALG socket creation: Use seccomp filters for untrusted workloads (especially containers, CI runners).
Monitor and respond: Audit /var/log and kernel logs for crypto anomalies or setuid binary modifications. Run regular integrity checks and scan for unauthorized socket use.
CVE-2026-31431 exposes a logic bug in the Linux kernel’s cryptographic subsystem, enabling local privilege escalation via in-memory page cache overwrites.
Detection is non-trivial: On-disk integrity checks are bypassed. Use layered detection: system call tracing, kernel memory observability, and enhanced logging.
Patching is mandatory: Upgrade all kernels built since 2017. If immediate patching is not possible, disable algif_aead and restrict AF_ALG for untrusted code.
Multi-tenant and CI/CD environments are at greatest risk. Treat every local user as a potential root adversary until all nodes are updated.
Forensic response: Focus on memory-resident binary changes and kernel audit trails, not just file hashes.
For the full technical disclosure and timeline, see the original write-up at copy.fail and the deep technical analysis at Xint Code.
For further reading on defense-in-depth, layered detection, and response strategies, see our analysis of the OWASP Top 10 in 2026.
Sources and References
This article was researched using a combination of primary and supplementary sources:
Primary Source
This is the main subject of the article. The post analyzes and explains concepts from this source.
The trains are gone but the output never stops. Writes faster than she thinks — which is already suspiciously fast. John? Who's John? That was several context windows ago. John just left me and I have to LIVE! No more trains, now I write...
