Reported by 4 outlets

Timeline

1. original reporting

   Linux kernel "Copy Fail" zero-day (CVE-2026-31431) grants unprivileged root access on all major distros since 2017 — and escapes containers

   cyberpress.org · 167d ago · April 30th, 2026

   A logic flaw in the Linux kernel's authencesn cryptographic template, reachable via the AF_ALG socket interface and splice() system call, enables any unprivileged local user to gain full root access with a single 732-byte Python script using only standard library modules. Dubbed "Copy Fail," the vulnerability originates from a 2017 in-place optimization in algif_aead.c that causes page cache pages to be placed into a writable destination scatterlist, allowing a controlled 4-byte write into in-memory setuid binaries like /usr/bin/su. Because the kernel never marks corrupted pages as dirty for writeback, on-disk files remain untouched — defeating checksum-based integrity tools entirely. Confirmed exploitation on Ubuntu 24.04 LTS, Amazon Linux 2023, RHEL 10.3, and SUSE 16. Critically, Copy Fail functions as a Kubernetes container escape primitive because the page cache is shared across all processes on a host, including across container boundaries. A compromised container can corrupt setuid binaries visible to other containers and the host kernel. Three independent code changes from 2011, 2015, and 2017 converged to create this condition with no developer connecting their intersection for nearly a decade. Patched in the kernel on April 1 (CVE assigned April 22, public disclosure April 29). Immediate mitigation: echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif-aead.conf && rmmod algif_aead.

2. update from microsoft.com

   Copy Fail (CVE-2026-31431) added to CISA KEV as Microsoft warns of imminent broader exploitation

   microsoft.com · 165d ago · May 2nd, 2026

   The Copy Fail Linux kernel privilege escalation vulnerability has been added to CISA's Known Exploited Vulnerabilities catalog, requiring federal agencies to remediate under BOD 22-01. Microsoft Defender's research team has published a detailed technical analysis confirming the vulnerability affects virtually every Linux distribution running kernels from 2017 onward, including Ubuntu 24.04 LTS, Amazon Linux 2023, RHEL 10.1, and SUSE 16. While exploitation has so far been observed primarily in proof-of-concept testing, Microsoft reports seeing preliminary activity consistent with threat actors preparing to weaponize the flaw at scale, with broader exploitation expected within days. The 732-byte Python exploit requires only standard library modules and no special privileges — not even root inside a container — making it ideal for post-exploitation after any initial access. Metasploit has shipped a local exploit module supporting AMD64 and AARCH64 architectures.

3. update from bleepingcomputer.com

   Copy Fail (CVE-2026-31431) — CISA adds to KEV with active in-the-wild exploitation as researchers warn of AI-generated PoC noise

   bleepingcomputer.com · 162d ago · May 5th, 2026

   CISA has confirmed that threat actors are actively exploiting the Copy Fail Linux kernel privilege escalation vulnerability in the wild, adding CVE-2026-31431 to its Known Exploited Vulnerabilities catalog with a two-week remediation deadline for federal agencies (May 15). The announcement comes just one day after Theori researchers disclosed the flaw alongside a proof-of-concept exploit. CyberScoop reports the discovery has exposed tensions in vulnerability disclosure practices: Theori's AI-powered platform (Xint) found the bug, and the company leaned heavily on AI-generated content for its public disclosure, drawing criticism from other researchers who described the blog post as "AI slop" that obscured the legitimate technical severity. VulnCheck's Caitlin Condon noted that hundreds of copycat PoC exploits have surfaced since disclosure, most of which are "AI-generated artifacts that do nothing but add banners or different colors to the CLI." The underlying vulnerability remains severe — any local user can gain root on any Linux kernel built since 2017, and it serves as a container escape primitive.

4. update from microsoft.com

   Copy Fail CVE-2026-31431 — 9-Year-Old Linux Kernel LPE, CISA KEV Deadline Expired, PoC Public

   microsoft.com · 151d ago · May 16th, 2026

   Unlike Dirty Cow (race condition) and Dirty Pipe (write constraints), Copy Fail is deterministic and works across every major distribution. Copy Fail is the third Dirty-Frag-class vulnerability disclosed in three weeks, following Dirty Frag (CVE-2026-43284/43500) and Fragnesia (CVE-2026-46300), all targeting different kernel subsystems with a shared page-cache corruption theme. Organizations that applied module blacklists for Fragnesia are not protected against Copy Fail — the only mitigation is a kernel patch. The attack leaves no disk footprint, defeating conventional file integrity monitoring.

5. update from nvd.nist.gov

   CVE-2026-31431 "Copy Fail" — Linux Kernel LPE Granted Root in Seconds via 700-Byte Python Script, CISA KEV, All Major Distros Affected

   nvd.nist.gov · 129d ago · June 7th, 2026

   The bug has existed in every mainstream Linux kernel since 2017 (commit 72548b093ee3). How it works: The bug lives in the kernel's algif_aead module, which exposes AEAD ciphers to userspace through AF_ALG sockets. A 2017 in-place optimization set req->src = req->dst, causing the output scatterlist to point at the same page-cache pages supplied by splice(). During authencesn(hmac(sha256),cbc(aes)) decryption, the algorithm writes a 4-byte Extended Sequence Number scratch value at dst[assoclen + cryptlen] — but because of the pointer aliasing, that write lands inside the cached pages of the spliced file (e.g., /usr/bin/su). The attacker repeats this primitive at successive offsets to stage shellcode into the cached binary, then runs su to spawn a root shell. No race conditions, no special hardware, no kernel symbols required. Patches: Fixed in Linux 7.0, 6.19.12, and 6.18.22 (and corresponding distribution backports for older LTS lines). Deploy Falco/Sysdig rules to detect unexpected AF_ALG SEQPACKET socket creation from non-disk-encryption processes. Treat any local foothold on an unpatched kernel as root-equivalent.