Copy Fail — Linux CVE-2026-31431: Root Access in 732 Bytes, Active Exploitation Confirmed by CISA
🐧 What is Copy Fail?
Copy Fail is a local privilege escalation flaw in the Linux kernel. In plain terms: any normal user on a Linux system can, within seconds, become root — the all-powerful user who controls the entire system.
The flaw is in the Linux kernel's cryptographic subsystem, specifically in the authencesn module. It was introduced in August 2017 during a code optimisation, and nobody noticed it for nearly 9 years — until an AI security tool called Xint Code found it in one hour.
- 100% reliable — no precise timing, no race condition. The same script works unchanged across all tested distributions
- No external dependencies — only standard Python libraries available everywhere
- Undetectable — the exploit writes nothing to disk, only modifying the kernel memory cache
- Breaks container isolation — Docker, Kubernetes, LXC are all vulnerable
- Active exploitation confirmed — CISA added CVE-2026-31431 to its KEV catalogue on 3 May 2026
🖥️ How it works (simply)
Without going into technical details, here's what the exploit does in 4 steps:
- Step 1: Opens a connection to the kernel's cryptographic interface via AF_ALG
- Step 2: Exploits the flaw to write 4 controlled bytes into the memory cache of
/usr/bin/su - Step 3: Replaces the binary in memory without ever touching disk — antivirus sees nothing
- Step 4: Runs
su— and gets a full root shell
📋 Which distributions are affected?
Any Linux kernel built between 2017 and the April 2026 patch is vulnerable — that's almost every Linux server in production.
✅ How to protect yourself now
- Ubuntu/Debian:
sudo apt update && sudo apt full-upgradethen reboot - RHEL/Rocky/AlmaLinux:
sudo dnf update kernelthen reboot - SUSE:
sudo zypper updatethen reboot - Fixed versions: kernels 6.18.22, 6.19.12, 7.0 and distro backports
- Disable the vulnerable module:
echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf - This disabling does not affect most applications (not LUKS, not SSH)
- US federal agencies have until 15 May 2026 to patch
🤔 What about home users?
If you don't use Linux on your personal computer, you're not directly affected. But this flaw impacts:
- Synology/QNAP NAS devices — often running Linux
- Raspberry Pi and home mini-servers
- Web servers hosting websites — including ones you might visit
- Android devices — based on the Linux kernel
- An AI found this flaw in 1 hour — not a human in 9 years
- AI accelerates vulnerability discovery in both directions — for defenders AND attackers
- Automatic updates are more important than ever — enable them on all your devices
Is your NAS or server vulnerable?
Describe your setup to CyberGuard — it'll guide you through checking and fixing it.
🤖 Talk to CyberGuard →