Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years
Summary: On April 29, 2026, researchers disclosed CVE-2026-31431, called Copy Fail, a deterministic local privilege escalation flaw in the Linux kernel's algif_aead module of the AF_ALG interface that lets an unprivileged local attacker escalate to root across major distributions released since 2017. A single 732-byte Python script exploits it unmodified across distributions by writing four controlled bytes into the file page cache of setuid-root binaries such as su and sudo, and it was found in about an hour through an AI-assisted process.
Why it matters: The flaw traces to a 2017 in-place optimization (commit 72548b093ee3) and affects kernels 4.14 through 6.19.12 across Ubuntu, Amazon Linux, RHEL, Debian, SUSE and AlmaLinux, with a public proof-of-concept already available and preliminary exploitation activity observed.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-31431CVE-2026-314331
- Related
- CVE-2026-31431: Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability Known Exploited Vulnerabilities · May 01, 2026