Security researchers have disclosed a serious flaw in the Linux kernel that lets any ordinary user on a machine take it over completely. Tracked as CVE-2026-31431 and nicknamed Copy Fail, the bug was made public on April 29, 2026 and analyzed by Unit 42's Justin Moore. It affects virtually every mainstream Linux distribution shipped since 2017, including Ubuntu, Debian, Red Hat Enterprise Linux, Amazon Linux, SUSE, and AlmaLinux. Because a low-privilege account is enough to gain root (full administrative control), and a tiny ready-made exploit already exists, Unit 42 rates Copy Fail as more dangerous than the well-known Dirty Cow and Dirty Pipe bugs.
What's affected
Linux kernel versions 4.14 through 6.19.12 are vulnerable. The problem lives in AF_ALG, a kernel feature that lets programs use built-in cryptography, and specifically in its algif_aead component. The root cause traces back to a performance shortcut added in a 2017 kernel change (commit 72548b093ee3) that let an operation reuse the same memory for both its input and its output. Under the right conditions, the authencesn algorithm (used for IPsec, a common way to encrypt network traffic) treats that shared memory as scratch space and writes four attacker-chosen bytes past where they belong, landing them directly in the page cache, the kernel's in-memory copy of files read from disk.
How the attack works
An unprivileged attacker steers exactly where those four bytes go and what they contain by tuning a handful of values they fully control. The classic move is to corrupt the cached, in-memory copy of a trusted setuid-root program such as /usr/bin/su, /usr/bin/sudo, or /usr/bin/passwd. The file on disk is never touched, so file integrity monitoring tools see nothing wrong, yet the next time the program runs from cache it executes the attacker's code as root (UID 0). After the system reboots or that memory is reclaimed, the clean copy reloads from disk, leaving almost no trace. Unit 42 warns the bug is especially nasty in shared environments: since every workload on a host shares one kernel and one page cache, Copy Fail also works as a container escape and can be used to take over multi-tenant servers, Kubernetes nodes, and CI/CD build pipelines whose temporary runners share a kernel.
What makes this stand out is how easy it is to use. There is no timing race to win, the exploit succeeds on the first try, and a 732-byte Python proof of concept (linked to the operator domain copy[.]fail and credited to Xint.Code in Unit 42's hunting queries) uses only standard libraries and runs unchanged across every affected distribution. Unit 42 expects it to be weaponized quickly.
What you should do
Apply your vendor's kernel updates right away. The upstream fix (commit a664bf3d603d) removes the 2017 shortcut and forces the operation to use separate input and output memory. If you cannot patch immediately, the Linux Foundation advisory suggests blocking the vulnerable module as a stopgap by running echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf and then rmmod algif_aead. Defenders should also watch for su or sudo being launched by unusual parent processes, and for any network traffic referencing copy[.]fail. Unit 42 has published Cortex XDR queries that cover both of these patterns.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.