The Deterministic Failure of Kernel Cryptography
CVE-2026-31431, known as Copy Fail, represents a significant departure from the typical, often unstable, landscape of local privilege escalation (LPE) exploits. Published on April 22, 2026, and subsequently added to the CISA Known Exploited Vulnerabilities catalog on May 1, 2026, this vulnerability targets the Linux kernel’s cryptographic subsystem. Specifically, it resides within the algif_aead module of the AF_ALG userspace crypto API.
The vulnerability is classified with a CVSS v3 score of 7.8 and a CVSS v4 score of 8.6. Most notably, it carries an EPSS score of 0.99907, indicating a near-certain probability of exploitation. This is not a theoretical research exercise; it is a reliable, deterministic tool for gaining a root shell from an unprivileged local user account.
Technical Mechanics of Copy Fail
The core of the issue is an incorrect resource transfer between spheres, specifically involving an in-place operation where source and destination buffers can overlap within the kernel’s cryptographic subsystem. This flaw allows for a controlled 4-byte write into the kernel page cache of any readable file. By targeting the in-memory representation of privileged binaries – such as /usr/bin/su – an attacker can achieve privilege escalation without ever modifying the actual file on the disk.
Because the exploit is race-condition-free, it avoids the instability that plagues many other kernel exploits. At a size of just 732 bytes, the exploit code is compact and highly effective. This method of corruption, which leaves the on-disk file system untouched, significantly complicates detection efforts for security teams relying on traditional file integrity monitoring.
Ecosystem Impact and Distribution
The reach of CVE-2026-31431 is broad, affecting major Linux distributions including Ubuntu 24.04 LTS, Amazon Linux 2023, RHEL 10.1, and SUSE 16. As detailed in the Microsoft Security Blog and the Tenable CVE database, the vulnerability is currently under active monitoring. Tenable has classified it as a Vulnerability of Interest under their Vulnerability Watch program, reflecting the severity of the risk to enterprise environments.
This exploit is not an isolated incident but rather a prominent entry in the 2026 series of Linux kernel LPE vulnerabilities. It follows a sequence of similar flaws, including DirtyFrag, DirtyClone, and Fragnesia. These recurring issues highlight a persistent challenge in maintaining the security of the kernel’s core subsystems.
Trust Architecture Implications
The cryptographic subsystem is intended to be the foundation of trust within the Linux kernel. When the interface responsible for securing data and verifying integrity becomes the vector for silent, deterministic privilege escalation, the entire security boundary is compromised. If the kernel’s own cryptographic mechanisms can be weaponized, the trust placed in any process or identity relying on those mechanisms is effectively nullified.
For identity architects and enterprise IT leaders, Copy Fail serves as a reminder that kernel-level vulnerabilities are increasingly moving toward deterministic, reliable execution. The ability to manipulate privileged binaries in memory without leaving a trace on the disk shifts the burden of defense away from static file analysis and toward more granular, runtime-based detection. As the industry continues to grapple with these kernel-level threats, the focus must remain on the mechanics of the exploit and the systemic weaknesses they expose in the underlying trust architecture.