Back Ground.News

Copy Fail Hits Linux: Tiny 4-Byte Flaw Opens Door to Root Access

Ground.News • April 30, 2026

Copy Fail (CVE-2026-31431) is a Linux kernel vulnerability that allows local unprivileged users to gain root access on affected systems.

Discovered and released this Thursday, the Linux "Copy Fail" fault (CVE-2026-31431) allows a simple local user to obtain complete root access on all major distributions since 2017, without any particular technical expertise.

A serious security vulnerability in the Linux kernel is currently causing a stir: The vulnerability called "Copy Fail" allows local users without special rights to obtain full administrator rights (root access). ( )

Security researchers have disclosed CopyFail, a local privilege escalation (LPE) vulnerability (CVE-2026-31431) in the Linux kernel.

A recently released critical vulnerability in the cryptographic subsystem of the Linux kernel allows full root-level rights expansion. The "Copy Fail" christened vulnerability affects almost all major distributions over the past nine years and can be exploited by a small Python script. The vulnerability under CVE-2026-31431 results from a logic error in the algif_aead module of the kernel crypto API.

Affecting the kernel’s authencesn cryptographic template, the vulnerability was introduced in 2017 and impacts all distributions.

To view factuality data please Upgrade to Premium

To view ownership data please Upgrade to Vantage

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Linux Vulnerability 'Copy Fail' Grants Root Access Across Major Distros A newly disclosed vulnerability in the Linux kernel, tracked as CVE-2026-31431 and named 'Copy Fail', allows unprivileged local users to gain root access on virtually all major Linux distributions released since 2017. The exploit, which is a 732-byte Python script, modifies the page cache of any readable file without altering the on-disk version, making it stealthy and difficult to detect. Discovered by Theori researcher Taeyang Lee using AI-assisted tools, the flaw stems from a logic error in the kernel's cryptographic subsystem, specifically within the algif_aead module. Patches were made available on April 1, 2026, following the initial disclosure on March 23, 2026, with public proof-of-concept released on April 30, 2026. The vulnerability poses a significant risk, especially in multi-tenant environments like cloud services and Kubernetes, where it can enable container escapes. Security teams are urged to apply patches immediately to mitigate risks associated with this critical flaw. 227 sources 73

Extracted Entities

Copy Fail Hits Linux: Tiny 4-Byte Flaw Opens Door to Root Access

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

MITRE ATT&CK (2)

Platforms (1)

Tools (1)

Vulnerabilities (2)