The security community has been focused for days on Copy Fail, the CVE-2026-31431 vulnerability affecting the Linux kernel that allows a local user without privileges to gain root privileges in a matter of seconds. The flaw, which has remained hidden since 2017, has set off alarm bells in European companies, cloud providers, and public administrations that rely on Linux for almost everything.
What worries cybersecurity teams most is not just the technical impact, but the combination of factors: a tiny exploit, a highly reliable logical flaw, and particularly difficult detection . In environments where third-party code runs daily—from shared servers in Spain to Kubernetes clusters in large European clouds—Copy Fail has become, overnight, an absolute priority.
What is Copy Fail (CVE-2026-31431) and how was it discovered?
Copy Fail is a local privilege escalation (LPE) vulnerability in the Linux kernel , tracked as CVE-2026-31431. It allows any user with the ability to execute code on the machine—a normal account, a process inside a Docker container, or a CI job—to elevate their privileges to root on vulnerable systems.
The vulnerability was published in late April 2026 by research teams such as Xint Code and Theori , who identified a proof-of-concept Python script of just 732 bytes capable of exploiting a logical error in the cryptographic subsystem. This small script, consisting of only a few lines, relies on AF_ALG sockets and the splice() function to corrupt the page cache of sensitive binaries and trigger privilege escalation.
According to technical analyses, the problem had been hidden since 2017 in kernels distributed by virtually all major Linux families. For almost nine years, the bug went undetected despite continuous audits and code reviews , sparking a profound debate about how performance optimizations are reviewed in such sensitive components as kernel cryptography.
One particularly striking detail is the role of artificial intelligence: automated code analysis tools, such as Xint Code, have been key to locating the vulnerability by detecting anomalous behavior patterns in the affected module. Without these solutions, many experts admit that it would have been very difficult to find the flaw manually.
The root of the problem: the cryptographic module algif_aead
At the heart of Copy Fail is the Linux kernel's cryptographic subsystem , specifically the algif_aead interface accessible from user space via AF_ALG sockets. This interface allows applications without special privileges to use kernel cryptographic functions for AEAD encryption and authentication operations.
The bug originates from an optimization introduced in 2017—referenced in several analyses as an "in-place" improvement commit in algif_aead—that inadvertently broke the module's security guarantees . The change was intended to improve performance by reusing input and output buffers, but it opened the door to out-of-bounds writing within the page cache.
The vulnerability is present in the authencesn cryptographic template, which combines HMAC-SHA256 with AES-CBC . During certain AEAD operations, part of the memory intended for output is used as a temporary working area, and due to the bug, 4 bytes are written just outside the expected area, onto a page of the system's file cache.
That tiny, controlled corruption, just four bytes, turns out to be enough to manipulate binaries with the setuid bit in memory, such as /usr/bin/su, sudo, or similar utilities. The file on disk isn't touched, but the copy in the page cache is, and it's precisely that copy that the kernel executes when the program is launched.
Memory copy, disk intact: why it's so hard to detect
One of the features that makes this vulnerability particularly sensitive is that it only alters the in-memory version of the files . Linux uses page caching to speed up file access: instead of always reading from disk, it keeps copies in RAM for faster response times.
Copy Fail exploits this mechanism to modify, through the algif_aead error, four specific bytes of the cache page of a binary chosen by the attacker . The key is that the kernel does not mark this page as "dirty," so it never writes the changes back to disk. From the file system's perspective, everything remains intact.
This has several practical consequences: firstly, integrity checks based on file hashes don't detect anything unusual because the physical content on disk doesn't change. Secondly, the trace of the attack is fleeting: a reboot or some memory pressure that forces the file to be reloaded from disk eliminates all traces of the previous corruption.
Furthermore, the exploit uses perfectly legitimate system calls (socket with AF_ALG, splice, execve of /usr/bin/su, etc.), so its behavior blends seamlessly with normal kernel traffic . Even advanced EDR solutions may struggle to distinguish legitimate use of AF_ALG from an exploit attempt unless very specific rules are applied.
How to exploit Copy Fail: AF_ALG, splice, and a tiny script
Researchers have demonstrated that a Python script of approximately 732 bytes is sufficient to exploit the vulnerability under real-world conditions. The process, in short, follows a relatively simple but highly effective sequence.
First, the exploit opens an AF_ALG socket configured in AEAD mode pointing to the vulnerable authencesn template. Then, it prepares a descriptor associated with the page cache of a target setuid binary, for example /usr/bin/su, and uses the splice() call to connect that cache page to the buffer that the kernel will use as the target for the cryptographic operation.
During the encryption/authentication operation, due to a bug introduced in 2017, the kernel code performs a 4-byte write operation outside the intended buffer range . The attacker controls both the input data and the request parameters, allowing them to decide which value is written and at what offset within the cache page.
By repeating this pattern as many times as necessary, the exploit can modify critical instructions in the binary stored in memory (for example, changing a password checking routine to a sequence that launches a privileged shell). When the attacker executes the modified binary, the kernel pulls from the cached copy instead of the disk, thus obtaining a real root shell.
An important point to note is that Copy Fail does not, on its own, open a backdoor from the internet . A prior vector is always needed to allow local code execution: a vulnerability in a website, a compromised account, a container with limited permissions, a poorly protected CI/CD script, etc. But once that first step is overcome, escalating to root with Copy Fail is, according to researchers, very reliable in conventional environments.
Systems and distributions affected: impact on Europe and business environments
Analyses published to date agree that virtually all Linux kernels distributed since 2017 that include algif_aead and AF_ALG enabled are affected by the vulnerability. This encompasses most distributions used in Spain and the rest of Europe, on servers, workstations, and in cloud environments.
The systems mentioned include Ubuntu, Debian, SUSE, Red Hat Enterprise Linux (RHEL), Amazon Linux, and various builds used in WSL2 . Ubuntu's LTS branches (16.04, 18.04, 20.04, 22.04 and later) have received or are receiving updates, although some unsupported versions—such as certain 18.04 kernels—will no longer receive official patches and remain permanently vulnerable.
In the case of Debian, security trackers indicate that versions of Bullseye, Bookworm, and Trixie with specific 5.x and 6.x kernels are or have been affected . Amazon Linux 2 and Amazon Linux 2023, widely used on EC2 instances and EKS nodes, are also listed as vulnerable with pending or recently released patches in various branches (5.4, 5.10, 5.15, 6.12, 6.18).
For European organizations hosting critical infrastructure—operators, banks, the public sector, or large hosting providers—this means that thousands of servers have required urgent kernel updates . Simply looking at the generic version number isn't enough: many distributions apply their own backports and patches, so it's essential to review each vendor's official security advisories.
The vulnerability has been rated at around 7,8 out of 10 on the CVSS scale , placing it in the "High Severity" category. While it's not a remote zero-day exploit that would allow for complete control of a system from the outside, its ability to transform limited local access into absolute control makes it a very serious risk to modern infrastructures in practice.
Why Copy Fail is so dangerous in cloud, containers, and CI/CD
On a home computer with a single user, the risk of copy failure might seem manageable at first glance. The real problem arises in multi-tenant architectures and environments where third-party code is routinely executed , something very common in Spanish and European companies that have migrated massively to the cloud.
In Kubernetes clusters, for example, an attacker who manages to execute code within a pod with limited permissions could use Copy Fail to break the container's isolation and escalate to the host node if the underlying kernel is unpatched. From there, compromising other pods or even the entire cluster is simply a matter of chaining together attacks.
The same applies to CI/CD runners (GitHub Actions, GitLab, Jenkins, internal systems) that compile code from multiple projects or run third-party tests. A flaw in a pipeline or a malicious repository could be the entry point to launch the exploit and take control of the host running the jobs.
In VPS and shared hosting providers, which are widespread in the Spanish and European market, a client with access to a seemingly isolated machine could use Copy Fail to jump to the physical system that hosts several virtual machines or containers , thus breaking the separation between clients.
All of this explains why the vulnerability has generated so much pressure among cloud providers, data centers, and operations teams: it's not just about protecting a specific machine, but about preserving the isolation boundaries that support entire business models.
Patch status and distribution response
The structural solution involves updating the kernel to a version that includes the Copy Fail patch . In the official Linux tree, the key change reverts the problematic optimization of algif_aead and hardens buffer management in the affected cryptographic operations.
The major distributions have reacted at varying speeds. Debian, Ubuntu, and SUSE released security updates quite quickly , covering both stable and LTS branches. Some very specific packages—such as certain IBM-optimized kernels in Ubuntu—have been marked as "unaffected" because they do not contain the vulnerable code.
In the case of Red Hat, the initial reaction was somewhat more cautious, with a plan to assess the impact before releasing patches across all branches. However, faced with community pressure and public proof-of-concept evidence, the company eventually accelerated the release of updates for its enterprise products, aware of the importance of RHEL within the European corporate landscape.
Amazon Linux, for its part, has been progressively updating its kernels for EC2 instances and EKS nodes . Even so, many administrators in Spain and other European countries have had to manually check which AMI and kernel branch each server was using, since not all images receive updates at the same pace.
In environments where older, unsupported versions are maintained, such as some Ubuntu 16.04 or 18.04 installations still present in small providers or legacy infrastructures, the situation is more delicate: these systems, in many cases, will not receive a patch , so continuing to use them permanently exposes them to Copy Fail and other recent vulnerabilities.
Temporary mitigation measures: what to do if you can't update now
Although the general recommendation is clear—patch and reboot the kernel as soon as possible—in practice, not all organizations can shut down critical services immediately . For these cases, researchers have described several temporary mitigation strategies that significantly reduce the attack surface.
The first method involves blacklisting the algif_aead module using modprobe . By adding appropriate rules, the module can be prevented from loading automatically and can even be unloaded from the running kernel with commands like rmmod, provided there are no active dependencies that would prevent it.
Another more robust option, recommended for untrusted workloads or high-risk environments, is to block the creation of AF_ALG sockets using seccomp policies or access control systems such as AppArmor or SELinux. This measure closes the main avenue for exploiting Copy Fail, but it can affect legitimate applications that rely on the kernel's cryptographic subsystem.
Some vendors and security teams also suggest reviewing and reducing the number of binaries with the setuid bit present in systems. While this doesn't eliminate the vulnerability, reducing the number of potential targets makes the attacker's task more difficult and limits the impact of a successful exploit.
In Ubuntu environments, examples have been published of using utilities like profix to check the status of the CVE on each system and help administrators apply temporary mitigations. However, these solutions should be understood as temporary fixes: the ultimate goal remains upgrading to a patched kernel.
How to detect exploitation attempts: auditing, SIEM, and EDR
Beyond patching, many organizations want to know if someone has attempted or successfully exploited Copy Fail on their systems. Since the attack leaves few obvious traces on disk , detection relies primarily on monitoring for suspicious behavior patterns at the system level.
One recurring recommendation is to configure auditd rules to monitor the use of splice() and AF_ALG by unprivileged users . For example, log splice calls that manipulate file descriptors associated with setuid binaries, such as su, sudo, passwd, gpasswd, newgrp, chfn, chsh, mount, or fusermount3, when they originate from interpreters like Python on atypical paths.
It is also advisable to monitor the creation of sockets with the AF_ALG domain (decimal value 26) initiated by interactive user UIDs (usually greater than or equal to 1000) on systems where intensive use of the kernel's cryptographic API from standard user applications is not expected.
EDR solutions and SIEM platforms are beginning to incorporate specific rules for Copy Fail , with names like possible_lpe_by_python or possible_copy_fail_cve_2026_31431. These rules typically correlate several events: reading setuid binaries, using splice, creating AF_ALG sockets, and subsequently launching a shell with elevated privileges.
For organizations with complex infrastructures—banking, energy, public sector—integrating these indicators of compromise into their centralized monitoring systems is key. While it doesn't guarantee the detection of all attempts, it significantly increases the likelihood of identifying ongoing exploitation or unauthorized internal testing.
Lessons learned from other kernel vulnerabilities: Dirty COW, Dirty Pipe, and others
Copy Fail is not the first privilege escalation vulnerability to hit the Linux kernel. In the last decade, flaws like Dirty COW (CVE-2016-5195) and Dirty Pipe (CVE-2022-0847) have become notorious , also exploiting the kernel's page cache and internal mechanisms to modify data that was, in theory, read-only.
The difference is that, while Dirty COW and Dirty Pipe focused more on arbitrary writing to files on disk or in pipes , Copy Fail acts almost exclusively on the copy in memory, without altering the physical content. For an attacker, this translates into a huge advantage in terms of stealth, since classic forensic analysis tools rely heavily on the state of the file system.
Another interesting aspect is that CVE-2026-31431 fits a pattern that many experts have been pointing out for some time: optimizing kernel performance without thoroughly evaluating the security implications can generate very serious vulnerabilities. A change intended to save CPU cycles in cryptographic operations has ended up exposing millions of servers.
For European companies that operate their own infrastructure or rely on cloud providers, the lesson is clear: kernel maintenance cannot be treated as a secondary task . Delaying updates for fear of "breaking production" accumulates technical debt that ultimately takes its toll in the form of increasingly complex security vulnerabilities.
This time, moreover, the role of artificial intelligence in the discovery of Copy Fail hints at another possible future: the same advanced techniques that today help locate bugs could be used to find them before the defenders do . Maintaining a culture of agile patching and continuous monitoring therefore becomes even more essential.
The Copy Fail (CVE-2026-31431) incident reinforces an idea that many European organizations are rapidly grasping: a single logical flaw at the core of the kernel can compromise containers, shared servers, and critical services in a matter of seconds . Updating kernels, disabling vulnerable modules where they are no longer needed, strengthening AF_ALG monitoring, and reviewing multi-tenant and CI/CD environments have become urgent tasks for any team managing Linux systems, from small businesses to large cloud providers.