Linux Kernel Zero-Day “Copy Fail” Gives Root Access Across Major Distributions Since 2017
A newly disclosed zero-day vulnerability in the Linux kernel could allow any unprivileged local user to gain root access on nearly all major Linux distributions released since 2017.
Known as “Copy Fail” and tracked as CVE-2026-31431, the flaw was initially identified by Theori researcher Taeyang Lee and later developed into a complete exploit chain by the Xint Code Research Team with AI-assisted analysis.
The bug is a straight-line logic flaw, not a race condition, in the kernel’s authencesn cryptographic template. It can be reached through the AF_ALG socket interface in combination with the splice() system call. Unlike earlier Linux privilege-escalation bugs such as Dirty Cow and Dirty Pipe, this issue does not depend on winning a race, using kernel-version-specific offsets, recompiling code, or deploying a compiled payload.
A 732-byte Python script using only standard library modules was reportedly enough to achieve deterministic root access across all tested distributions and architectures.
The exploit works by targeting the kernel’s page cache, the in-memory representation of files, and causing a controlled 4-byte write into a page cache page belonging to any file the attacker can read. Because the altered page is never marked dirty for writeback, the file on disk remains unchanged, allowing checksum-based integrity tools to miss the tampering. An attacker can then run the modified in-memory version of a setuid binary such as /usr/bin/su to obtain a root shell.
The vulnerability traces back to a 2017 in-place optimization added to algif_aead.c in commit 72548b093ee3. When a file is spliced into a pipe and then fed into an AF_ALG socket, the AEAD input scatterlist can reference the file’s physical page cache pages directly rather than copies. For AEAD decryption, algif_aead.c assigned req->src = req->dst, causing both source and destination to point to the same combined scatterlist.
As a result, writable destination scatterlists could include page cache pages. The authencesn algorithm, used by IPsec for 64-bit Extended Sequence Number (ESN) support, then used the caller’s destination buffer as scratch space and wrote 4 bytes beyond the declared output boundary at offset assoclen + cryptlen, directly into chained page cache pages.
Researchers said the flaw emerged from the interaction of three separate code changes made in 2011, 2015, and 2017, creating an exploitable condition that went unnoticed for nearly a decade.
The same exploit script reportedly produced a root shell on all four tested platforms:
- Ubuntu 24.04 LTS – kernel
6.17.0-1007-aws - Amazon Linux 2023 – kernel
6.18.8-9.213.amzn2023 - RHEL 14.3 – kernel
6.12.0-124.45.1.el10_1 - SUSE 16 – kernel
6.12.0-160000.9-default
The issue was introduced with kernel 4.14 and affects distributions running vulnerable versions until patched.
Beyond local privilege escalation, Copy Fail may also be used as a Kubernetes container escape primitive. Because page cache is shared across processes on the same host, including across container boundaries, a compromised container could corrupt setuid binaries accessible to other containers and even the host system. Xint Code said a second part of its research covers full Kubernetes node compromise.
Patch and Mitigation
The official fix, introduced in commit a664bf3d603d, changes algif_aead.c back to out-of-place AEAD operation, permanently separating the TX scatterlist, which may contain page cache pages, from the RX scatterlist used as the output buffer. This removes the sg_chain() path that allowed page cache pages to become part of the writable destination.
Until patched kernels are deployed, administrators are advised to:
- Install the upstream kernel fix through their distribution’s update channel
- Disable the algif_aead kernel module to remove the exposed attack surface
The vulnerability was reported to the Linux kernel security team on March 23, 2026. Patches were committed to mainline on April 1, 2026, a CVE was assigned on April 22, 2026, and public disclosure followed on April 29, 2026.
System administrators are urged to apply kernel updates as soon as possible.