Copy Fail Linux Vulnerability CVE-2026-31431 Lets Local Users Escalate to Root Without Password

A vulnerability in the Linux kernel, tracked as CVE-2026-31431 and dubbed “Copy Fail,” has been publicly disclosed and is now drawing urgent attention from security agencies and vendors.

Multiple outlets tie the flaw to a local privilege escalation path that can move an unprivileged user to root, with the mechanism described as operating through the kernel’s cryptographic subsystem.

01net

ADSLZone says the issue was made public “ayer 29 de abril” by Xint/Theori, and it describes the flaw as allowing “un usuario local sin privilegios” to elevate permissions “hasta root.”

Android MT similarly frames it as a flaw “present in the Linux kernel since 2017,” and says it enables root rights “without a password” and “with an exploit that fits in 732 bytes.”

Numerama reports that the vulnerability was “Disclosed on April 29, 2026 by Theori researchers via their Xint Code tool,” and it emphasizes that it affects the Linux kernel “in its standard configuration.”

Across the coverage, the common thread is that the exploit targets in-memory behavior rather than modifying the file on disk, which is described as making it harder to detect with integrity checks.

ADSLZone notes that “no modifica el archivo en disco,” while LeMagIT says the corruption is “undetectable by standard disk-based integrity verification tools that rely on checksums, because only the in-memory content is corrupted.”

The reporting describes Copy Fail as a logic flaw in the Linux kernel’s cryptographic path, with the attack using a user-accessible interface and a memory-cache manipulation technique.

ADSLZone says Copy Fail “afecta al subsistema criptográfico del kernel de Linux” and that it affects “la interfaz algif_aead, relacionada con operaciones AEAD accesibles desde espacio de usuario.”

ADSLZone

It further describes the flaw as “un bug lógico en authencesn que permite una escritura controlada de 4 bytes en la page cache,” and it stresses that the change is not written to disk.

Android MT provides additional mechanics, saying the kernel exposes “a special network interface, AF_ALG,” which allows programs to access cryptographic operations, and it describes how an optimization introduced in 2017 can cause a normally read-only file to end up in an output area that a program can modify.

Android MT says the attack chains “splice() system calls” to write “four bytes at a time into the page cache,” and it gives a concrete example of targeting a protected binary “such as /usr/bin/su.”

LeMagIT similarly says the exploit targets “a weakness in the 'authencesn' cryptographic model” accessible via “the user-space AF_ALG socket interface,” and it describes the use of “splice()” to inject page references into the cryptographic socket’s input.

SecurityWeek’s account aligns with this, saying the bug allows attackers to “modify the cache page of readable setuid-root binaries to elevate privileges to root,” and it ties the template to “authencesn AEAD.”

Numerama adds that the page cache is consulted when executing a program, and it explains that modifying the page cache changes what the system will execute “without ever touching the file on disk.”

The coverage repeatedly stresses that Copy Fail is a local privilege escalation issue that requires local code execution, but it still poses a risk to shared and containerized environments because the page cache is described as shared across processes on a host.

“In brief - Critical flaw in the Linux kernel present since 2017 - Discovered by an AI agent in under an hour - Root privileges escalation without a password or precise timing A vulnerability that had slept for almost a decade The flaw, dubbed Copy Fail (CVE-2026-31431), is chilling”

Android MT

ADSLZone says the flaw “requiere ejecución local” and that it “no se trata de un ataque remoto por sí solo,” while also warning that the risk is “alto” for “servidores compartidos” and “clústeres Kubernetes.”

Android MT similarly notes that exploitation requires local access, but it highlights multi-tenant exposure in “Docker containers,” “Kubernetes clusters,” and “CI/CD pipelines.”

SOC Prime describes the practical impact as including “container-escape potential,” and it says the flaw “can also be used to escape containers and compromise shared or CI-driven environments.”

Numerama emphasizes that the page cache is shared among all processes on a host, so exploitation from within a container “can affect the entire machine,” and it lists “cloud platforms, CI/CD pipelines, and AI agent sandboxes.”

On mitigation, ADSLZone says “La medida principal para solucionar el problema pasa por actualizar el kernel a una versión corregida por la distribución,” and it adds that “No basta con mirar la versión general de Linux” because distributions apply patches.

It also describes a temporary mitigation to limit or disable the vulnerable module, while Android MT provides a specific command: “echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif-aead.conf.”

SecurityWeek adds operational guidance, urging organizations to “apply patches, isolate the systems, apply access controls, and review logs for signs of exploitation,” and it frames the threat as “full root privilege escalation” with potential “container breakout, multi-tenant compromise, and lateral movement.”

The most prominent institutional reaction in the sources comes from the U.S. Cybersecurity and Infrastructure Security Agency, which is described as warning that Copy Fail is being exploited in the wild and adding it to its Known Exploited Vulnerabilities catalog.

CXO Digitalpulse says “The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning” and urges organizations “to take immediate action as the flaw is now being actively exploited in the wild.”

BleepingComputer

It adds that CISA’s inclusion in its “Known Exploited Vulnerabilities (KEV) catalog” signals “confirmed real-world attacks” and “elevates the urgency for remediation.”

SecurityWeek likewise reports that “CISA warns” exploitation is underway and that the vulnerability was “added to its Known Exploited Vulnerabilities (KEV) catalog on Friday,” while also urging federal agencies to patch “within two weeks.”

The Tech Buzz says CISA “added the CopyFail bug to its Known Exploited Vulnerabilities catalog” and describes the designation as “reserved for flaws that adversaries are actively using in the wild.”

Microsoft’s position is also quoted in SecurityWeek, which says Microsoft observed “only limited in-the-wild exploitation, mainly surrounding proof-of-concept (PoC) testing,” while warning that “a working PoC exploit has been released.”

SecurityWeek quotes Microsoft’s assessment that “Successful exploitation leads to full root privilege escalation” and that it “could facilitate container breakout, multi-tenant compromise, and lateral movement within shared environments.”

It also quotes Microsoft on stealth and reliability, saying “Its reliability, stealth (in-memory-only modification), and cross-platform applicability make it particularly dangerous in cloud, CI/CD, and Kubernetes environments where untrusted code execution is common.”

Several outlets focus on how Copy Fail was discovered and how AI is being used in vulnerability research, while other reporting highlights disputes about the quality and presentation of disclosure materials.

Android MT says the flaw was identified by Taeyang Lee, a researcher at Theori, “thanks to their AI-based audit tool, Xint Code,” and it claims “Xint Code delivered Copy Fail as the critical result in under an hour.”

Brodersen

It also describes the targeted directive given to the AI agent, saying Lee “gave it a highly targeted directive” to examine paths accessible from user space in the crypto subsystem and emphasize “splice() behavior.”

LeMagIT attributes technical understanding to “Xint Code teams,” which explain that “The algorithm uses memory that does not belong to it as temporary buffer,” and it describes the overwrite as “a write of four bytes beyond the contractual limits.”

CyberScoop, however, frames the story as a mix of real exploitation and “AI slop,” quoting Spencer McIntyre of Rapid7 saying, “The attacker would need to have already established a foothold on the target system either through some means of legitimate access or another exploit,” and it adds that “That’s a large limiting factor since this vulnerability would therefore need to be paired with another.”

CyberScoop also quotes Caitlin Condon of VulnCheck saying, “It’s not helpful that the blog is AI slop, because it detracts from technical reality,” and it includes a quote from Theori’s Tim Becker: “We used AI to help craft the disclosure site and the blog post to help speed things up, but all material was thoroughly reviewed by our internal teams for accuracy.”

On detection and operational readiness, LeMagIT says “The Nextron Systems teams have also published Yara and Sigma detection rules,” while SOC Prime advises defenders to “Monitoring should also cover suspicious changes involving setuid binaries and execution patterns resembling copy_fail_exp.py or related exploitation behaviors.”