[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fXbdLD-DfqazT6jHI2IbSp-oPW3mJ_jSQ426HKF15PsI":3},{"article":4,"iocs":42},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":31,"category":32,"article_tags":36},"7bdc425e-411f-4913-b855-8f6881d6ece3","New Linux 'Copy Fail' Vulnerability Enables Root Access on Major Distributions","new-linux-copy-fail-vulnerability-enables-root-access-on-major-distributions-ea092c","Cybersecurity researchers have disclosed details of a Linux local privilege escalation (LPE) flaw that could allow an unprivileged local user to obtain root. The high-severity vulnerability tracked as CVE-2026-31431 (CVSS score: 7.8) has been codenamed Copy Fail by Xint.io and Theori. \"An unprivileged local user can write four controlled bytes into the page cache of any readable file on a Linux","Researchers at Xint.io and Theori disclosed CVE-2026-31431, a high-severity local privilege escalation flaw in the Linux kernel's algif_aead cryptographic module affecting all major distributions since 2017. The vulnerability allows an unprivileged local user to corrupt the page cache of setuid binaries using a simple 732-byte Python exploit, achieving reliable root access without race conditions. The flaw echoes Dirty Pipe (CVE-2022-0847) and has cross-container impacts due to shared page cache across system processes.","Linux kernel 'Copy Fail' vulnerability (CVE-2026-31431) enables unprivileged users to gain root access via page cache","New Linux 'Copy Fail' Vulnerability Enables Root Access on Major Distributions Ravie LakshmananApr 30, 2026Linux \u002F Vulnerability Cybersecurity researchers have disclosed details of a Linux local privilege escalation (LPE) flaw that could allow an unprivileged local user to obtain root. The high-severity vulnerability tracked as CVE-2026-31431 (CVSS score: 7.8) has been codenamed Copy Fail by Xint.io and Theori. \"An unprivileged local user can write four controlled bytes into the page cache of any readable file on a Linux system, and use that to gain root,\" the vulnerability research team at Xint.io and Theori said. At its core, the vulnerability stems from a logic flaw in the Linux kernel's cryptographic subsystem, specifically within the algif_aead module. The issue was introduced in a source code commit made in August 2017. Successful exploitation of the shortcoming could allow a simple 732-byte Python script to edit a setuid binary and obtain root on essentially all Linux distributions shipped since 2017, including Amazon Linux, RHEL, SUSE, and Ubuntu. The Python exploit involves four steps - Open an AF_ALG socket and bind to authencesn(hmac(sha256),cbc(aes)) Construct the shellcode payload Trigger the write operation to the kernel's cached copy of \"\u002Fusr\u002Fbin\u002Fsu\" Call execve(\"\u002Fusr\u002Fbin\u002Fsu\") to load the injected shellcode and run it as root While the vulnerability is not remotely exploitable in isolation, a local unprivileged user can get root simply by corrupting the page cache of a setuid binary. The same primitive also has cross-container impacts as the page cache is shared across all processes on a system. In response to the disclosure, Linux distributions have released their own advisories - Amazon Linux Debian Red Hat Enterprise Linux SUSE Ubuntu Copy Fail has its echoes in Dirty Pipe (CVE-2022-0847), another Linux kernel LPE vulnerability that could permit unprivileged users to splice data into the page cache of read-only files and ultimately overwrite sensitive files on the system to achieve code execution. \"Copy Fail is the same class of primitive, in a different subsystem,\" Bugcrowd's David Brumley said. \"The 2017 in-place optimization in algif_aead allows a page-cache page to end up in the kernel’s writable destination scatterlist for an AEAD operation submitted over an AF_ALG socket. An unprivileged process can then drive splice() into that socket and complete a small, targeted write into the page cache of a file it doesn't own.\" What makes the vulnerability dangerous is that it can be reliably triggered and does not require any race condition or kernel offset. On top of that, the same exploit works across distributions. \"This vulnerability is unique because it has four properties that almost never appear together: it's portable, tiny, stealthy, and cross-container,\" a Xint.io spokesperson told The Hacker News in a statement. \"It allows any user account, no matter how low-level, to increase their privilege to full admin access. It also allows them to bypass sandboxing and works across all Linux versions and distributions.\" Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  Cloud security, Container Security, cybersecurity, linux, Open Source, privilege escalation, Vulnerability Trending News Harvester Deploys Linux GoGra Backdoor in South Asia Using Microsoft Graph API Malicious KICS Docker Images and VS Code Extensions Hit Checkmarx Supply Chain Apple Fixes iOS Flaw That Let FBI Recover Deleted Signal Messages Vercel Finds More Compromised Accounts in Context.ai-Linked Breach ThreatsDay Bulletin: $290M DeFi Hack, macOS LotL Abuse, ProxySmart SIM Farms +25 New Stories Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign LMDeploy CVE-2026-33626 Flaw Exploited Within 13 Hours of Disclosure FIRESTARTER Backdoor Hit Federal Cisco Firepower Device, Survives Security Patches Researchers Uncover Pre-Stuxnet ‘fast16’ Malware Targeting Engineering Software ⚡ Weekly Recap: Fast16 Malware, XChat Launch, Federal Backdoor, AI Employee Tracking and More Checkmarx Confirms GitHub Repository Data Posted on Dark Web After March 23 Attack Microsoft Confirms Active Exploitation of Windows Shell CVE-2026-32202 Chinese Silk Typhoon Hacker Extradited to U.S. Over COVID Research Cyberattacks Microsoft Patches Entra ID Role Flaw That Enabled Service Principal Takeover Researchers Discover Critical GitHub CVE-2026-3854 RCE Flaw Exploitable via Single Git Push Critical cPanel Authentication Vulnerability Identified — Update Your Server Immediately Popular Resources Discover Key AI Security Gaps CISOs Face in 2026 Fix Rising Application Security Risks Driven by AI Development Automate Alert Triage and Investigations Across Every Threat How to Identify Risky Browser Extensions in Your Organization","https:\u002F\u002Fthehackernews.com\u002F2026\u002F04\u002Fnew-linux-copy-fail-vulnerability.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhYpnBkrLNj-dAKcwAbvRIvfXg8YDXoO3yfrl3vvXBOBwo2zga2asWZ0at4FLcLbiqQ1N7BsYA2szKbuqeVLBkrD80tMqYguBbqvrhEude6Fe9ayQpNs-meP8h4-f6ReWVeIU0zYp31XU7K-Kgxm5OKdI77HPQWgTx41al_WH3gYkMjEoROl6zvXF8HPRf5\u002Fs1600\u002Froot.jpg","2026-04-30T09:24:00+00:00","2026-04-30T10:00:39.665111+00:00",9,[18,21,23,25,27,29],{"name":19,"type":20},"Linux","vendor",{"name":22,"type":20},"Amazon",{"name":24,"type":20},"Red Hat",{"name":26,"type":20},"SUSE",{"name":28,"type":20},"Canonical",{"name":30,"type":20},"Debian","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",[43,47],{"type":44,"value":45,"context":46},"cve","CVE-2026-31431","Linux kernel local privilege escalation via algif_aead module page cache corruption",{"type":44,"value":48,"context":49},"CVE-2022-0847","Dirty Pipe — related Linux kernel LPE vulnerability in page cache"]