Linux Kernel Flaw Enables Unprivileged Root Access

Security researchers at Theori have disclosed a high-severity vulnerability in the Linux kernel, tracked as CVE-2026-31431 and dubbed Copy Fail, that allows unprivileged local users to gain root access on major Linux distributions released since 2017. A proof-of-concept exploit, a 732-byte Python script, was publicly released this week, demonstrating reliable privilege escalation across systems including Ubuntu 24.04 LTS, Amazon Linux 2023, Red Hat Enterprise Linux 10.1 and SUSE 16.

The flaw stems from a logic error in the kernel's authencsn cryptographic template within the algif_aead module. By combining the AF_ALG socket interface with the splice system call, an attacker can perform a controlled four-byte write into the page cache of any readable file. If targeted at a setuid-root binary, such as /usr/bin/su, this alters its in-memory execution without modifying the on-disk file, evading standard integrity checks. The issue originated from an in-place optimization added in kernel version 4.14 in 2017, which reused buffers for input and output during authenticated encryption with associated data operations.

Theori researcher Taeyang Lee discovered the vulnerability using the...