Linux ‘Copy Fail’ Flaw Delivers Root-Level Access to Distros

The Linux kernel needs to be patched to fix a vulnerability that exists in every distribution of the operating system created from 2017, onward. Successfully exploiting the flaw in the kernel’s cryptography API would give an attacker root-level access to the operating system.

See Also: AI Agents Introduce a New Insider Threat Model

“An unprivileged local user can write 4 controlled bytes into the page cache of any readable file on a Linux system, and use that to gain root,” said researchers at offensive security firm Theori on Wednesday of the local privilege escalation flaw, CVE-2026-31431. They nicknamed it “Copy Fail.”

“Most major distributions are shipping the fix now,” they said. As a temporary mitigation, users can “disable the algif_aead module” to block the flaw from being exploited, although potentially at the cost of some functionality, they said.

The module is part of the Linux kernel’s cryptographic subsystem, and typically ships active by default.

Theori released a proof-of-concept exploit. Other researchers have also published their own scripts.

The risk posed by the flaw is serious, security experts said. “If you described this bug to a top kernel researcher – give me a universal Linux LPE, works across major distributions, no race window, no per-kernel offsets, clean container-escape primitive – they probably wouldn’t give you a timeline. They’d tell you this is the kind of thing that, when it exists at all, tends to sell on the broker market for the price of a house,” said David Brumley, chief artificial intelligence and science officer at bug bounty firm Bugcrowd, in a blog post.

The biggest risk posed by the new vulnerability is to any environment that runs “multi-tenant Linux, shared-kernel containers, CI runners that execute untrusted code or anything where someone you don’t fully trust can execve” – aka run applications – “as a regular user,” Theori researchers said.

They see a “medium” risk for stand-alone Linux servers, and “low” risk for anyone running a “single-user laptop with full-disk encryption and a locked screen.” Regardless, their advice is to “patch anyway.”

The vulnerability carries a CVSS base score of 7.8, which ranks as “high.”

Bugcrowd’s Brumley said: “Don’t be fooled by the ‘high’ – not critical – CVSS score. If your stack runs untrusted code and the isolation story has the word ‘container’ in it without the word ‘microVM,’ ‘gVisor,’ or ‘dedicated host’ right after it, Copy Fail is in your threat model.” Don’t assume Linux containers that can run untrusted code remain safe, he said.

AI-Assisted Bug Discovery

The flaw is the latest to be found by researchers using the latest AI tools for scanning code (see: Bug Management in the Mythos Era: ‘Assume You’re Unpatched’).

Theori said one of its researchers discovered the flaw, assisted by an AI tool, when “studying how the Linux crypto subsystem interacts with page-cache-backed data.” The researcher used Theori’s in-house large language model, which the firm describes as being an AI-powered, LLM-native security analysis tool developed for scanning source code, configuration files and binaries for vulnerabilities.

Finding the vulnerability took about one hour of time to scan “the Linux crypto/subsystem,” and involved no “harnessing,” meaning no agents or wraparounds.

As tools improve, much less experienced researchers may be able to achieve similar results. “Copy Fail is not a story about a single bug, or about one team’s tooling. It’s a data point that the cost of finding deep logic flaws may have dropped by something like an order of magnitude,” Brumley said.

Detecting Exploit Attempts

One upside for defenders is that attempts to exploit this flaw can be noisy, provided they have the right observability.

Cybersecurity consultancy Threatbear recommends using the Linux kernel Extended Berkeley Packet Filter technology to watch for unexpected attempts to create the required socket connection – known as AF_ALG – that touches kernel memory, which would normally not be direct but instead handled using a user space library such as OpenSSL.

“The core mechanism of this vulnerability involves the kernel doing a temporary ‘scratch write’ of a sequence number during the crypto operation. That scratch write is strictly limited to 4 bytes,” it said.

Since most root shell payloads would require about 160 bytes of assembly code, the attacker needs to do the attack in stages. “They have to trigger the vulnerability, write 4 bytes, trigger the vulnerability again, write the next 4 bytes and so on, inching their way through the file cahe,” Threatbear said.

When viewed with eBPF, such socket connection attempts from unexpected scripts should be a “glowing red flag” that an attack is in progress, it said.