Nearly every Linux system built since 2017 vulnerable to ‘Copy Fail’ flaw
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-31431 | Local Privilege Escalation (Copy Fail) in Linux Kernel algif_aead Interface CVE-2026-31431 ('Copy Fail') is an incorrect resource transfer between spheres (CWE-669/CWE-1288) in the Linux kernel's algif_aead implementation of the AF_ALG userspace crypto interface, introduced roughly nine years ago (around 2017, per public reporting) when commit 72548b093ee3 switched AEAD operations to in-place handling even though the source and destination buffers come from different mappings. A local, unprivileged user can trigger the flaw by performing AEAD operations through the AF_ALG socket interface, causing the kernel to mishandle the copy of ciphertext and associated data. Successful exploitation provides a reliable local privilege escalation to root (C:H/I:H/A:H per the CVSS vector). Nearly every major Linux distribution and enterprise platform is exposed, including the kernel itself, Red Hat Enterprise Linux (including AUS, EUS, TUS and Update Services for SAP Solutions), OpenShift Container Platform, Amazon Linux, Ubuntu, Debian, openSUSE Leap, SUSE CaaS Platform, NixOS, and Linux-based products from Arista and Siemens. The flaw has public proof-of-concept code, a 99.9% EPSS score, and was added to CISA's Known Exploited Vulnerabilities catalog on 2026-05-01, indicating exploitation in the wild (ransomware use is unknown). Do: Patch by installing the kernel update for CVE-2026-31431 through your distribution's security channel (Red Hat Enterprise Linux including AUS/EUS/TUS/SAP channels, OpenShift, Amazon Linux, Ubuntu, Debian, openSUSE Leap, SUSE CaaS Platform, NixOS, and Arista/Siemens firmware/software as applicable) and reboot into the patched kernel; the data provides no fixed version numbers, so defer to vendor advisories. Because the flaw is in CISA's KEV catalog (added 2026-05-01) with a 99.9% EPSS score, prioritize internet-reachable and multi-user systems first and follow BOD 22-01 guidance for cloud services. Check running kernel versions ('uname -r') and distribution advisory status to confirm you are on a fixed build. | 7.8 | 100% | KEV PoC ×5 |
| masshundreds of millions to billions of installations (servers, cloud instances, desktops, and Android/embedded devices running affected kernel generations) |
Full article445 words · extracted from therecord.media · click to collapse
Security researchers and European cybersecurity officials are urging administrators to address the risk posed by a newly discovered security flaw that has been hiding in the Linux operating system for nearly a decade. The bug allows anyone with a basic account on an affected computer to seize full administrative control. It also works as an escape route from cloud containers, meaning a compromised application running inside a supposedly isolated environment can break out and take control of the entire host server — a major risk given the cloud industry’s dependence on Linux distributions. Patches and mitigations began reaching users Thursday, though some systems remain unprotected. An interim workaround circulating online does not function correctly on all distributions. The flaw, dubbed “Copy Fail,” was publicly disclosed this week by researchers at cybersecurity firm Theori, which said it found the bug using an AI-powered scanning tool called Xint Code. The vulnerability is being tracked as CVE-2026-31431 and has been assigned a CVSS base score of 7.8. It affects every major Linux distribution released since 2017, including Ubuntu, Red Hat Enterprise Linux, Amazon Linux and SUSE, the systems running the majority of the world's servers and cloud infrastructure. The EU's cybersecurity body, CERT-EU, issued a formal advisory on Thursday warning about the risk posed by the bug and urged administrators to apply the kernel update as soon as patches are available. Theori said the flaw resulted from three separate, individually unremarkable changes to the Linux kernel made in 2011, 2015 and 2017. No one recognized the danger created by their combination for nearly a decade. The attack works by quietly tampering with the temporary copy of a file the system holds in memory while it is in use, without ever touching the original file on disk. As standard security tools check files on disk rather than in memory, they see nothing wrong. An attacker can exploit that gap to rewrite the rules of a trusted system program and take over the machine. CERT-EU noted that while a fix had been committed to the underlying Linux codebase on April 1 — after Theori reported the issue on March 23 — no major distribution had yet delivered it to end users as of its advisory. The U.S. Cybersecurity and Infrastructure Security Agency has not yet added the flaw to its known exploited vulnerabilities catalog, indicating it has not been observed in active attacks.
No previous article
No new articles
Alexander Martin
is the UK Editor for Recorded Future News. He was previously a technology reporter for Sky News and a fellow at the European Cyber Conflict Research Initiative, now Virtual Routes. He can be reached securely using Signal on: AlexanderMartin.79
Text extracted automatically; images, tables and formatting may be missing. Original: https://therecord.media/linux-vulnerability-copy-fail-patch