New Linux 'Copy Fail' Vulnerability Enables Root Access on Major Distributions
Summary: Researchers at Xint.io and Theori disclosed CVE-2026-31431, a high-severity Linux local privilege escalation flaw (CVSS 7.8) codenamed Copy Fail, stemming from a logic flaw in the kernel's algif_aead cryptographic module introduced in an August 2017 commit. A 732-byte Python script can write four controlled bytes into the page cache of a setuid binary to gain root on essentially all Linux distributions shipped since 2017, including Amazon Linux, RHEL, SUSE, and Ubuntu.
Key Takeaway: The same exploit works across distributions, needs no race condition or kernel offset, and the shared page cache gives it cross-container reach, so a single low-level user account can escalate to full admin and bypass sandboxing on nearly every Linux system built in the last eight years.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2022-0847CVE-2026-31431
- Related
- CVE-2026-31431: Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability Known Exploited Vulnerabilities · May 01, 2026CVE-2022-0847: Linux Kernel Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Apr 25, 2022