Linux kernel local privilege escalation wave: Copy Fail, ZcopyReaper and IPv6 use-after-free drive CERT-EU, Ubuntu and ZDI advisories

A cluster of Linux kernel local privilege escalation (LPE) flaws drew advisories from CERT-EU, Ubuntu, oss-security and ZDI between 29 April and 9 September 2026: Copy Fail (CVE-2026-31431, CVSS 7.8, AF_ALG/algif_aead, public PoC), ZcopyReaper…

Between 29 April and 9 September 2026, four sources - CERT-EU, the Ubuntu Security Notices, the oss-security mailing list and the Zero Day Initiative - published advisories on Linux kernel vulnerabilities, most of them local privilege escalation (LPE) issues. None of the sources reports exploitation in the wild: CERT-EU notes only a public proof of concept for Copy Fail, and ZDI states that exploitation has not been observed for its finding. CERT-EU advisory 2026-005 (disclosed 29 April 2026) covers CVE-2026-31431, dubbed 'Copy Fail' and rated CVSS 7.8: a local privilege escalation in the kernel's algif_aead module of the AF_ALG crypto API, stemming from a 2017 in-place optimisation. Chaining an AF_ALG socket operation with splice() lets an unprivileged user write 4 bytes into an arbitrary page-cache page, for example corrupting a setuid binary such as /usr/bin/su to obtain a root shell. Virtually all kernels built since 2017 are affected, including Ubuntu 20.04-24.04, Amazon Linux 2023, RHEL 10.1 and SUSE 16. The mainline fix landed on 1 April 2026, but CERT-EU reported no distribution packages available as of 30 April 2026, and a public proof of concept was released at copy.fail. CERT-EU recommends the interim mitigations of disabling algif_aead or blocking AF_ALG with seccomp, prioritising Kubernetes nodes and CI/CD runners exposed to untrusted workloads. On 8 September 2026, Yuan Tan reported on oss-security an LPE in the RDS zerocopy send path, tracked as CVE-2026-43502 and dubbed ZcopyReaper; a follow-up thread places it in the net/rds (Reliable Datagram Sockets) subsystem. The flaw was introduced in Linux v4.17 and fixed by commit 44b550d88b26, first appearing in mainline v7.1-rc3, and the researchers demonstrated local privilege escalation on an openSUSE system running kernel 6.4.0-150600.23.100. The post was headlined alongside about 20 additional kernel LPEs for which CVE ids were not provided in the excerpts; a later thread describes the batch as roughly 21 LPEs published in the 2026 Q3 window and tracked in the kernel.org security vulnerabilities git repository. The visible discussion does not state whether any of the flaws are exploited in the wild and gives no patch guidance beyond the individual reports, though one discussant notes that locking kernel module loading after boot has repeatedly proven an effective mitigation. On 7 September 2026 Ubuntu issued five kernel updates. USN-8726-1 (generic), USN-8727-1 (OEM) and USN-8728-1 (GCP)…