Cybersecurity researchers have disclosed details of a Linux local privilege escalation (LPE) flaw that could allow an unprivileged local user to obtain root.
The high-severity vulnerability tracked as CVE-2026-31431 (CVSS score: 7.8) has been codenamed Copy Fail by Xint.io and Theori.
“An unprivileged local user can write four controlled bytes into the page cache of any readable file on a Linux system, and use that to gain root,” the vulnerability research team at Xint.io and Theori said.
At its core, the vulnerability stems from a logic flaw in the Linux kernel’s cryptographic subsystem, specifically within the algif_aead module. The issue was introduced in a source code commit made in August 2017.
Successful exploitation of the shortcoming could allow a simple 732-byte Python script to edit a setuid binary and obtain root on essentially all Linux distributions shipped since 2017, including Amazon Linux, RHEL, SUSE, and Ubuntu. The Python exploit involves four steps -
- Open an AF_ALG socket and bind to authencesn(hmac(sha256),cbc(aes))
- Construct the shellcode payload
- Trigger the write operation to the kernel’s cached copy of “/usr/bin/su”
- Call execve(“/usr/bin/su”) to load the injected shellcode and run it as root
While the vulnerability is not remotely exploitable in isolation, a local unprivileged user can get root simply by corrupting the page cache of a setuid binary. The same primitive also has cross-container impacts as the page cache is shared across all processes on a system.
Though this is a severe exploit, note that you need already user access to the machine to use it.
Dor like … Everyone here who learns from it cis this need it’s likely a non issue. Still good practice to fix but if you didn’t share your user space this will not be the attack vector you will fall victim to - most likely.
Any one of the programs or docker containers you run has user access. Now any of them could have root access unchecked. You can’t know you haven’t installed an update with malicious code to any one of the hundreds of packages a desktop install has.
If I understand correctly, this could be exploited to escape linux namespaces, which which are the foundation of containers like Flatpak and Docker. Those were never very good security boundaries, but running untrusted code in them is now especially dangerous, until your kernel is patched.