If your kernel was built between 2017 and the patch — which covers essentially every mainstream Linux distribution — you're in scope.
Copy Fail requires only an unprivileged local user account — no network access, no kernel debugging features, no pre-installed primitives. The kernel crypto API ( AF_ALG ) ships enabled in essentially every mainstream distro's default config, so the entire 2017 → patch window is in play out of the box.
Distributions we directly verified:
These are what we tested directly. Other distributions running affected kernels — Debian, Arch, Fedora, Rocky, Alma, Oracle, the embedded crowd — behave the same. Tested it elsewhere? Open an issue to add to the list.
Should you patch first?
Shared dev boxes, shell-as-a-service, jump hosts, build servers — anywhere multiple users a kernel.
The page cache is shared across the host. A pod with the right primitives compromises the node and crosses tenant boundaries.
GitHub Actions self-hosted runners, GitLab runners, Jenkins agents — anything that executes untrusted PR code as a regular user, on a shared kernel.
Notebook hosts, agent sandboxes, serverless functions, any tenant-supplied container or script.
Single-tenant production where only your team has shell access.
You're already the only user. The bug doesn't grant remote attackers access by itself, but any local code execution becomes root.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
