Security researchers have detailed a Linux kernel vulnerability unofficially called Copy Fail, identified as CVE-2026-31431, that can allow attackers to gain root access on virtually any modern Linux distribution. The issue affects kernels released between 2017 and 2026, which means both older server setups and newer systems may be exposed if the relevant kernel component is present.

According to the published information, the flaw is notable not only because it can lead to privilege escalation, but also because a working exploit can be extremely small and rely on normal system behavior. The source says the exploit uses standard system calls, making it difficult to distinguish from legitimate activity. The vulnerability is local rather than remote, but it can still be valuable in an attack chain after initial access has already been achieved.

What Copy Fail affects

The issue is tied to the Linux kernel and is connected to a commit added in 2017 that introduced support for in-place operations for AEAD encryption in the algif_aead module. The source says that this change led to a buffer handling error. The root cause has therefore been described in the report, though the broader impact depends on whether the vulnerable module is installed and loaded in the host kernel.

Systems named in the report as being at risk include:

• Ubuntu
• RHEL
• certain WSL2 builds
• other systems with the algif_aead module installed

The source also notes that the vulnerability is especially important for modern Linux environments because it can affect both outdated server configurations and current distributions. That broad scope makes it relevant across many deployment types, not just niche or legacy installations.

How the exploit works

The report explains that the authencesn cryptographic algorithm uses part of allocated memory as a temporary buffer and writes four bytes directly to the file page cache. In practical terms, that behavior allows an attacker to modify the cache for any readable file. The exploit shown in the report is a minimal Python script of about 732 bytes that uses the AF_ALG interface and the splice() system call.

By writing four controlled bytes into the cache of a file such as an executable with the setuid bit set, the attacker can alter the program’s code in RAM. On the next launch, the modified program can run malicious actions with superuser privileges. The file on disk remains unchanged, which means integrity checks that rely on the on-disk file may not detect the problem.

Important points from the report include:

• the exploit is local, not remote
• no race conditions or memory address guessing are required
• the attack can be used after gaining RCE or by an insider
• the file on disk remains intact while RAM contents are altered

Why containers are also a concern

The source says Copy Fail is especially significant in containerized environments. By default, Docker, LXC, and Kubernetes can give processes inside a container access to the AF_ALG subsystem if the algif_aead module is loaded into the host kernel. That means the flaw may be used to break container isolation and potentially gain control over the physical machine.

This makes the vulnerability relevant not only to hosts running Linux directly, but also to environments where Linux kernels support multiple isolated workloads. The report emphasizes that this increases the impact because the same underlying kernel weakness can affect more than one deployment style.

Detection and mitigation

Detection is described as difficult because the exploit depends on legitimate system calls that resemble ordinary application activity. The source says a Python-based exploit can be hard to spot for that reason. Kaspersky also added detection rules for SIEM environments and container checks for the possibility of CVE-2026-31431 using Kaspersky Container Security.

The report states that a fix has already been incorporated into the stable branches of the Linux kernel. The developers addressed incorrect buffer validation when processing in-place cryptographic operations. That means the primary mitigation path is to apply the kernel update containing the fix and review whether affected modules are present in exposed systems.

Conclusion

Copy Fail is a serious Linux kernel vulnerability because it can lead to root access using a small, local exploit and can affect a wide range of systems released over nearly a decade. Its impact is especially concerning in containerized environments, where kernel-level access can undermine isolation. Applying the fixed kernel versions and using detection tooling are the key steps highlighted in the source.