Critical Linux kernel vulnerability "Copy Fail" discovered
IT security researchers have discovered a serious vulnerability in the Linux kernel that allows local attackers to gain root privileges. The flaw, dubbed "Copy Fail", affects all Linux distributions available since 2017. With a Python script of just 732 bytes, attackers can perform a privilege escalation and gain full control over the system.
The vulnerability has been classified as CVE-2026-31431 and received a CVSS score of 7.8, which is rated as "high" risk. It was discovered using the AI tool Xint Code, which underlines the growing importance of automated security analysis.
Technical details of the vulnerability
"Copy Fail" is a logic flaw in the Linux kernel that allows local users to perform a deterministic, controlled 4-byte write to the page cache of any readable file system on a machine. The researchers were able to demonstrate how a binary with the setuid flag can be manipulated in order to gain root privileges.
Particularly problematic is that the kernel does not mark the manipulated page as "dirty" for write-back to the drive. As a result, the original file remains unchanged and simple checksum checks cannot detect the manipulation. When the file is actually accessed, however, the manipulated page cache is used.
Impact on container security
The vulnerability also makes it possible to break out of container boundaries, since the page cache is shared on the host. The researchers have announced further publications that will discuss escaping from Kubernetes containers. This makes the flaw particularly relevant for modern IT infrastructures built on container technologies.
Affected systems and tested combinations
The security researchers successfully tested the vulnerability on various Linux distributions:
- Ubuntu 24.04 LTS with kernel 6.17.0-1007-aws
- Amazon Linux 2023 with kernel 6.18.8-9.213.amzn2023
- RHEL 10.1 with kernel 6.12.0-124.45.1.el10_1
- SUSE 16 with kernel 6.12.0-160000.9-default
The bug lies in the crypto subsystem of the Linux kernel and its interaction with page cache data. The discovery was based on detailed investigations of these system components.
Immediate measures and patches
The researchers have already provided a fix for the kernel source code. Updated kernels should now be available from the larger distributions. As a temporary countermeasure, the experts recommend one of two options:
Option 1: Block AF_ALG socket creation
The creation of AF_ALG sockets can be blocked via seccomp.
Option 2: Disable the algif_aead module
The algif_aead module can be added to the blacklist so that the kernel does not load it. This is done with the following command:
echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif-aead.conf && rmmod algif_aead 2>/dev/null
Significance for IT security
The discovery of "Copy Fail" is part of a series of critical Linux vulnerabilities. Only a few days earlier, Telekom had used AI to uncover the "Pack2TheRoot" vulnerability in Linux, likewise a privilege escalation flaw that could be exploited in the default configurations of several Linux distributions.
This development is particularly relevant for operators of critical infrastructure and security systems. Video surveillance systems, access control systems or other security-critical applications based on Linux could potentially be affected.
Outlook and recommendations
The accumulation of AI-assisted vulnerability discoveries shows that automated security analysis is ushering in a new era of cybersecurity. Both attackers and defenders are increasingly using artificial intelligence to identify security gaps.
System administrators should check immediately whether their Linux systems are affected by the vulnerability and install the corresponding updates. The available temporary countermeasures offer short-term protection until full patches can be installed.
The researchers' release of a detailed proof-of-concept exploit underlines the urgency of security updates. Organisations should review their patch management processes and ensure that critical security updates are applied promptly.
