New Linux 'Copy Fail' Vulnerability Enables Root Access on Major Distributions

This article discusses the CVE-2026-31431 "Copy Fail" vulnerability, a high-severity Linux kernel flaw that enables local privilege escalation.

• •The vulnerability stems from a logic flaw in the Linux kernel's cryptographic subsystem (algif_aead module) introduced in August 2017
• •An unprivileged local user can write controlled bytes into the page cache of readable files to gain root access
• •Successful exploitation uses a simple 732-byte Python script that targets setuid binaries like /usr/bin/su
• •The flaw affects all Linux distributions since 2017, including Amazon Linux, RHEL, SUSE, and Ubuntu
• •Unlike similar vulnerabilities, Copy Fail is portable, reliable, stealthy, and works across all Linux versions without requiring race conditions