Linux kernel local privilege escalation wave: Copy Fail, ZcopyReaper and IPv6 use-after-free drive CERT-EU, Ubuntu and ZDI advisories
A cluster of Linux kernel local privilege escalation (LPE) flaws drew advisories from CERT-EU, Ubuntu, oss-security and ZDI between 29 April and 9 September 2026: Copy Fail (CVE-2026-31431, CVSS 7.8, AF_ALG/algif_aead, public PoC), ZcopyReaper…
Between 29 April and 9 September 2026, four sources - CERT-EU, the Ubuntu Security Notices, the oss-security mailing list and the Zero Day Initiative - published advisories on Linux kernel vulnerabilities, most of them local privilege escalation (LPE) issues. None of the sources reports exploitation in the wild: CERT-EU notes only a public proof of concept for Copy Fail, and ZDI states that exploitation has not been observed for its finding. CERT-EU advisory 2026-005 (disclosed 29 April 2026) covers CVE-2026-31431, dubbed 'Copy Fail' and rated CVSS 7.8: a local privilege escalation in the kernel's algif_aead module of the AF_ALG crypto API, stemming from a 2017 in-place optimisation. Chaining an AF_ALG socket operation with splice() lets an unprivileged user write 4 bytes into an arbitrary page-cache page, for example corrupting a setuid binary such as /usr/bin/su to obtain a root shell. Virtually all kernels built since 2017 are affected, including Ubuntu 20.04-24.04, Amazon Linux 2023, RHEL 10.1 and SUSE 16. The mainline fix landed on 1 April 2026, but CERT-EU reported no distribution packages available as of 30 April 2026, and a public proof of concept was released at copy.fail. CERT-EU recommends the interim mitigations of disabling algif_aead or blocking AF_ALG with seccomp, prioritising Kubernetes nodes and CI/CD runners exposed to untrusted workloads. On 8 September 2026, Yuan Tan reported on oss-security an LPE in the RDS zerocopy send path, tracked as CVE-2026-43502 and dubbed ZcopyReaper; a follow-up thread places it in the net/rds (Reliable Datagram Sockets) subsystem. The flaw was introduced in Linux v4.17 and fixed by commit 44b550d88b26, first appearing in mainline v7.1-rc3, and the researchers demonstrated local privilege escalation on an openSUSE system running kernel 6.4.0-150600.23.100. The post was headlined alongside about 20 additional kernel LPEs for which CVE ids were not provided in the excerpts; a later thread describes the batch as roughly 21 LPEs published in the 2026 Q3 window and tracked in the kernel.org security vulnerabilities git repository. The visible discussion does not state whether any of the flaws are exploited in the wild and gives no patch guidance beyond the individual reports, though one discussant notes that locking kernel module loading after boot has repeatedly proven an effective mitigation. On 7 September 2026 Ubuntu issued five kernel updates. USN-8726-1 (generic), USN-8727-1 (OEM) and USN-8728-1 (GCP)…
- CVE-2026-31431 ('Copy Fail', CVSS 7.8): local privilege escalation in the Linux kernel AF_ALG algif_aead module, rooted in a 2017 in-place optimisation (CERT-EU 2026-005, disclosed 29 April 2026).
- Copy Fail primitive: chained AF_ALG socket operation plus splice() yields a 4-byte arbitrary write into an arbitrary page-cache page; corrupting a setuid binary such as /usr/bin/su yields a root shell.
- Copy Fail scope: virtually all kernels built since 2017, including Ubuntu 20.04-24.04, Amazon Linux 2023, RHEL 10.1 and SUSE 16; the mainline fix landed 1 April 2026, but no distribution packages were available as of 30 April 2026.
- Copy Fail: public proof of concept released at copy.fail; interim mitigations are disabling algif_aead or blocking AF_ALG with seccomp, prioritising Kubernetes nodes and CI/CD runners exposed to untrusted workloads.
- CVE-2025-10263: certain Arm processors complete broadcast TLB invalidation before related memory writes are globally observed, potentially letting local attackers bypass memory protections or escalate privileges.
- Ubuntu 7 September 2026 USNs: USN-8726-1 (generic), USN-8727-1 (OEM) and USN-8728-1 (GCP) fix CVE-2025-10263; USN-8728-1 additionally fixes CVE-2025-54518, an AMD Zen 2 operation cache isolation flaw enabling privilege escalation.
- USN-8729-1 fixes multiple kernel flaws across ARM32/ARM64/PowerPC, Bluetooth, GPU, InfiniBand, network drivers, Azure MANA, SCSI, SPI, SMB, NTFS3 and EFI core; USN-8730-1 fixes IPv6 networking and Netfilter flaws (no CVE ids listed in the…
- CVE-2026-43502 ('ZcopyReaper'): LPE in the RDS zerocopy send path (net/rds subsystem), introduced in Linux v4.17, fixed by commit 44b550d88b26, first appearing in mainline v7.1-rc3; reported by Yuan Tan on oss-security on 8 September 2026.
Coverage timelineoldest first · each row is one article
- · Apr 29, 20262026-005: High Vulnerability in the Linux Kernel ("Copy Fail")
CERT-EU Advisories· 68
Linux kernel flaw CVE-2026-31431 ('Copy Fail', CVSS 7.8) allows unprivileged users to gain root via AF_ALG; a public PoC is out and most distros remain unpatched.
- · 9d agoUSN-8726-1: Linux kernel vulnerabilities
Ubuntu Security Notices· 28
Ubuntu issued kernel security update USN-8726-1 fixing an Arm TLB invalidation flaw (CVE-2025-10263) that enables local privilege escalation, plus other kernel fixes.
- · 9d agoUSN-8727-1: Linux kernel (OEM) vulnerabilities
Ubuntu issued kernel security update USN-8727-1 for OEM kernels, fixing an Arm TLB invalidation flaw (CVE-2025-10263) allowing local privilege escalation.
- · 9d agoUSN-8728-1: Linux kernel (GCP) vulnerabilities
Ubuntu issued kernel security update USN-8728-1 for GCP kernels fixing Arm TLB and AMD Zen 2 privilege escalation flaws (CVE-2025-10263, CVE-2025-54518).
- · 9d agoUSN-8729-1: Linux kernel vulnerabilities
Ubuntu issued USN-8729-1 fixing Linux kernel vulnerabilities across ARM, Bluetooth, GPU, SCSI, SMB, and Azure MANA subsystems.
- · 9d agoUSN-8730-1: Linux kernel vulnerability
Ubuntu issued USN-8730-1 fixing Linux kernel flaws in IPv6 networking and Netfilter that could allow system compromise.
Vulnerabilities in this storyAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-10263 | Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level. NVD description · AI analysis pending | 9.1 | <1% | — | — | ||
| CVE-2025-54518 | Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instructions executed at a diff Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instructions executed at a different privilege level, potentially resulting in privilege escalation. NVD description · AI analysis pending | 7.3 | <1% | — | — | ||
| CVE-2026-31431 | Local Privilege Escalation (Copy Fail) in Linux Kernel algif_aead Interface CVE-2026-31431 ('Copy Fail') is an incorrect resource transfer between spheres (CWE-669/CWE-1288) in the Linux kernel's algif_aead implementation of the AF_ALG userspace crypto interface, introduced roughly nine years ago (around 2017, per public reporting) when commit 72548b093ee3 switched AEAD operations to in-place handling even though the source and destination buffers come from different mappings. A local, unprivileged user can trigger the flaw by performing AEAD operations through the AF_ALG socket interface, causing the kernel to mishandle the copy of ciphertext and associated data. Successful exploitation provides a reliable local privilege escalation to root (C:H/I:H/A:H per the CVSS vector). Nearly every major Linux distribution and enterprise platform is exposed, including the kernel itself, Red Hat Enterprise Linux (including AUS, EUS, TUS and Update Services for SAP Solutions), OpenShift Container Platform, Amazon Linux, Ubuntu, Debian, openSUSE Leap, SUSE CaaS Platform, NixOS, and Linux-based products from Arista and Siemens. The flaw has public proof-of-concept code, a 99.9% EPSS score, and was added to CISA's Known Exploited Vulnerabilities catalog on 2026-05-01, indicating exploitation in the wild (ransomware use is unknown). Do: Patch by installing the kernel update for CVE-2026-31431 through your distribution's security channel (Red Hat Enterprise Linux including AUS/EUS/TUS/SAP channels, OpenShift, Amazon Linux, Ubuntu, Debian, openSUSE Leap, SUSE CaaS Platform, NixOS, and Arista/Siemens firmware/software as applicable) and reboot into the patched kernel; the data provides no fixed version numbers, so defer to vendor advisories. Because the flaw is in CISA's KEV catalog (added 2026-05-01) with a 99.9% EPSS score, prioritize internet-reachable and multi-user systems first and follow BOD 22-01 guidance for cloud services. Check running kernel versions ('uname -r') and distribution advisory status to confirm you are on a fixed build. | 7.8 | 100% | KEV PoC ×5 |
| masshundreds of millions to billions of installations (servers, cloud instances, desktops, and Android/embedded devices running affected kernel generations) | |
| CVE-2026-43502 | In the Linux kernel, the following vulnerability has been resolved: In the Linux kernel, the following vulnerability has been resolved: net/rds: handle zerocopy send cleanup before the message is queued A zerocopy send can fail after user pages have been pinned but before the message is attached to the sending socket. The purge path currently infers zerocopy state from rm->m_rs, so an unqueued message can be cleaned up as if it owned normal payload pages. However, zerocopy ownership is really determined by the presence of op_mmp_znotifier, regardless of whether the message has reached the socket queue. Capture op_mmp_znotifier up front in rds_message_purge() and use it as the cleanup discriminator. If the message is already associated with a socket, keep the existing completion path. Otherwise, drop the pinned page accounting directly and release the notifier before putting the payload pages. This keeps early send failure cleanup consistent with the zerocopy lifetime rules without changing the normal queued completion path. NVD description · AI analysis pending | 7.8 | <1% |
| — |