The cybersecurity landscape is once again facing a critical threat as active exploitation of the “Copy Fail” Linux kernel vulnerability has been detected in the wild. This vulnerability, tracked as CVE-2026-31431, allows unprivileged local users to gain root privileges on vulnerable systems, posing a significant risk to a wide range of Linux distributions. The urgency of this situation is underscored by CISA’s addition of the flaw to its Known Exploited Vulnerabilities (KEV) Catalog and the subsequent directive for federal agencies to apply patches immediately.

Vulnerability Details

CVE-2026-31431, dubbed “Copy Fail,” resides within the Linux kernel’s algif_aead cryptographic algorithm interface. This flaw enables a local, unprivileged attacker to achieve root privileges by writing four controlled bytes into the page cache of any readable file. The vulnerability affects Linux kernel versions shipped since 2017, making a vast number of systems susceptible to exploitation.

Proof-of-Concept Exploit

At its core, the bug is a logic flaw in the algif_aead / authencesn implementation of the AF_ALG userspace crypto API, introduced as part of an optimization for in-place operations.

Root Cause

The vulnerability stems from incorrect handling of memory during cryptographic operations. Specifically, the kernel allows page-cache-backed memory (including read-only file mappings) to be used as a writable destination buffer during AEAD operations.

Because of this flawed assumption, an attacker can trigger a condition where the kernel performs a controlled write into the page cache of a file that should be immutable. This is not a traditional buffer overflow or race condition, but a deterministic logic bug that reliably enables modification of cached file data.

The key primitives involved are:

AF_ALG sockets (userspace interface to kernel crypto)
splice() system call, which can pass page-cache references without copying
In-place AEAD processing, which incorrectly treats read-only pages as writable

Together, these allow an attacker to redirect writes into sensitive file-backed memory.

Exploitation Primitive: Controlled Page Cache Write

The vulnerability gives attackers a powerful primitive:

a controlled 4-byte write into the page cache of any readable file

This is significant because:

The write occurs in memory (page cache), not on disk
The kernel does not mark the page as dirty, so it is never flushed back
File integrity tools that rely on disk checksums remain unaware

This makes the attack both stealthy and reliable.

Privilege Escalation Path

To escalate privileges, the attacker targets a setuid-root binary (e.g., /usr/bin/su). The exploitation flow is:

Open a readable setuid binary
- The attacker does not need write permissions – only read access.
Leverage AF_ALG + splice()
- Construct a crypto request that causes the kernel to treat page-cache memory as a writable buffer.
Corrupt the binary in memory
- Use the 4-byte write primitive to modify critical instructions or data in the cached copy of the binary.
Execute the modified binary
- When executed, the binary runs with root privileges, but now contains attacker-controlled modifications.

Because the modification exists only in memory, the disk version remains unchanged, further reducing detection.

Reliability and Impact

Unlike many kernel exploits, Copy Fail is notable for its extreme reliability and portability:

No race conditions or timing dependencies
No need for kernel version–specific offsets
Works across virtually all Linux distributions since 2017
Exploit code can be as small as ~732 bytes

From a security standpoint, successful exploitation yields:

Lateral movement in multi-tenant systems
Full root privilege escalation
Potential container escape in shared environments

CISA Action and BOD 22-01

In response to the active exploitation, CISA added CVE-2026-31431 to its Known Exploited Vulnerabilities (KEV) Catalog. As mandated by Binding Operational Directive (BOD) 22-01, Federal Civilian Executive Branch (FCEB) agencies are required to patch their Linux endpoints and servers within two weeks, with a deadline of May 15. This directive underscores the severity of the vulnerability and the potential impact on federal systems.

While BOD 22-01 is specifically applicable to U.S. government agencies, CISA has strongly urged all security teams to prioritize patching CVE-2026-31431 to secure their networks against potential attacks.

Mitigation and Recommendations

Given the active exploitation of the “Copy Fail” vulnerability, organizations are advised to take the following steps:

Apply Patches: Immediately apply the latest security patches provided by Linux vendors to address CVE-2026-31431.
Discontinue Use: If mitigations are unavailable, consider discontinuing the use of the affected product.
Monitor Systems: Closely monitor systems for any signs of unauthorized access or privilege escalation.

Tactics, Techniques, and Procedures (TTPs)

The exploitation of the Copy Fail vulnerability aligns with the following MITRE ATT&CK tactic and technique:

TA0004 – Privilege Escalation: Exploiting a vulnerability in the Linux kernel to gain elevated privileges.
T1068 – Exploitation for Privilege Escalation: Leveraging CVE-2026-31431 to achieve root access from an unprivileged account.

Instantly Fix Risks with Saner Patch Management

Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.

It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.

Experience the fastest and most accurate patching software here.