Copy Fail: The 732-Byte Linux Kernel Bug That Slept Since 2017

An unprivileged local user gains root deterministically. The exploit weighs 732 bytes. The bug had been in the kernel since 2017. This is CVE-2026-31431, dubbed "Copy Fail" by researchers at Xint.io and Theori, who disclosed it on April 29, 2026.

Key Takeaways

CVE-2026-31431 carries a CVSS 7.8 (HIGH): local access, low complexity, full impact on confidentiality, integrity, and availability.
The 732-byte exploit writes 4 controlled bytes into the in-memory page cache without altering files on disk.
The bug resides in the algif_aead module since 2017; the fix is commit a664bf3d603d from April 1, 2026.
Confirmed vulnerable distributions: Ubuntu 24.04 LTS, Amazon Linux 2023, RHEL 10.1, SUSE 16, Rocky Linux 9.7.

Three Commits, One Arbitrary-Write Primitive

The vulnerability is an interaction bug across three kernel changes. In 2017, a developer introduced an in-place optimization in algif_aead.c that allowed the AF_ALG crypto subsystem to reuse input buffers as output. In 2023, a second developer changed how splice() handles page references. In 2024, a third optimized the page-cache write path. None of the changes was flawed in isolation.

The chain creates a condition where page-cache pages — normally read-only for unprivileged processes — end up in a writable destination scatterlist during AEAD operations. A process opens an AF_ALG socket, splices it to a readable file, and gains a 4-byte write primitive at arbitrary page-cache locations.

According to Xint.io researchers, quoted by The Hacker News: "An unprivileged local user can write four controlled bytes into the page cache of any readable file on a Linux system, and use this to gain root privileges."

The corruption occurs exclusively in memory. The kernel does not mark the corrupted page as dirty, so it is never flushed to disk. The original file remains intact, but processes that read it — including setuid binaries — execute the modified code. This mechanism is documented by Kaspersky SecureList and TurboLab.it.

"This vulnerability is unique because it has four properties that almost never appear together: it's portable, tiny, stealthy, and cross-container" — Xint.io Spokesperson, via The Hacker News

The Shared Page Cache and Container-Escape Risk

Containers share the kernel with the host. The page cache escapes namespace isolation: it is a single global kernel data structure shared by all system processes. A container with unprivileged access to a host-readable file can corrupt its page cache.

Kaspersky SecureList has documented the risk for multi-tenant environments: Docker, LXC, and Kubernetes are affected because the attack requires no additional capabilities. According to Theori researchers, quoted by TurboLab.it: "Chain it with anything that gets you in — a web RCE landing in an unprivileged service account, an SSH foothold, a malicious PR on a CI runner — and you're root."

The exploit works deterministically, with no race conditions. David Brumley of Bugcrowd placed Copy Fail in a class of recurring fragility: "Copy Fail is the same class of primitive, in a different subsystem."

Patch and Confirmed Distributions

The fix commit a664bf3d603d was merged into the Linux kernel mainline on April 1, 2026. The CVE-2026-31431 record, published by CVE.org, confirms the CVSS 7.8 score with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H and identifies both the vulnerable commit and the fix commit. CERT-EU issued an advisory with high priority.

HelpNetSecurity verified the distribution status as of April 30, 2026. Confirmed vulnerable distributions include Ubuntu 24.04 LTS, Amazon Linux 2023, RHEL 10.1, SUSE 16, and Rocky Linux 9.7. Ubuntu 26.04 and later kernels are unaffected. CISA added CVE-2026-31431 to the Known Exploited Vulnerabilities catalog with a May 15, 2026 deadline for U.S. federal agencies.

The Arch Linux security tracker published affected/fixed versions for its distribution. Exploit variants in Go and Rust have emerged, documented by Kaspersky SecureList.

What to Do Now

Primary sources document three mitigations. First: apply the kernel patch as soon as it is available from your distribution. Second: where applicable, disable the algif_aead module if not needed for cryptographic operations; CERT-EU confirms this does not break dm-crypt/LUKS, IPsec, OpenSSL, or SSH. Third: monitor the Go and Rust exploit variants reported by Kaspersky SecureList.

The exact number of compromised systems in the wild is unknown. Despite the convergence of technical sources, the brief does not document in-the-wild exploitation beyond the published PoC variants. The source does not specify the effectiveness of Kaspersky detection rules against non-Python variants.

Why It Matters

Eight years of dormancy for a bug that requires only local access and a Python interpreter. The exploit's determinism — no race conditions, no hardware-dependent timing — makes it reproducible. Its size, 732 bytes, makes it portable. The absence of disk traces makes it stealthy against file-based integrity checks.

The primitive class — page-cache corruption as a privilege-escalation vector — is not new, as Brumley notes. The novelty is the convergence of properties in a single subsystem accessible to an unprivileged user. The algif_aead module, designed for accelerated cryptographic operations, turns out to be an entry point for arbitrary memory writes.

The source does not specify why the vulnerability remained dormant for eight years, nor the specific contribution of the Xint Code AI tool versus the human insight of Taeyang Lee in the discovery.

Information has been verified against cited sources and is current as of publication.

Sources

Sources and references