Copy Fail: A 732-Byte Python Script Gives Local Root on Every Major Linux Distro Since 2017, and CISA Orders Federal Agencies to Patch by May 15
CVE-2026-31431, discovered by Theori using its AI scanner Xint Code, lets unprivileged users root Ubuntu, Amazon Linux, RHEL, and SUSE through a logic flaw in the kernel's crypto subsystem.
Overview
The U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-31431, a Linux kernel local privilege escalation flaw nicknamed Copy Fail, to its Known Exploited Vulnerabilities catalog and ordered federal civilian agencies to patch by May 15, 2026, according to The Hacker News. The bug, rated 7.8 on the CVSS scale, lets an unprivileged local user gain root on virtually every major Linux distribution shipped since 2017 by running a 732-byte Python script that abuses the kernel’s cryptographic subsystem, as reported by The Register.
Copy Fail was discovered by Taeyang Lee of the offensive-security firm Theori with assistance from the company’s AI scanning software, Xint Code, The Register reported. Theori reported the issue to the Linux kernel security team on March 23, and patches became available within a week, according to BleepingComputer.
What We Know
The vulnerability lives in the kernel’s authencesn cryptographic template. By chaining the AF_ALG socket interface with the splice() system call, an attacker can perform a controlled four-byte write into the page cache of any readable file on the system, according to BleepingComputer. Because the kernel reads the page cache when loading a binary, the corruption effectively rewrites a setuid executable in memory and yields root, The Register reported. The Register summarised the primitive as letting “an unprivileged local user write four controlled bytes into the page cache of any readable file on a Linux system, and use that to gain root.”
Unlike earlier Linux page-cache attacks such as Dirty Cow and Dirty Pipe, Copy Fail does not require winning a race condition, The Register noted. The exploit is also compact: researchers at Theori said “Copy Fail is more portable. One script, every distro, no offsets,” according to BleepingComputer.
The published proof of concept was tested against Ubuntu 24.04 LTS, Amazon Linux 2023, Red Hat Enterprise Linux 10.1, and SUSE 16, BleepingComputer reported. The Hacker News added Debian, Fedora, and Arch Linux to the list of affected distributions and noted that the flaw “impacts Linux distributions shipped since 2017,” in its writeup.
Fixes are available in upstream kernel versions 6.18.22, 6.19.12, and 7.0, The Hacker News reported. Debian, Ubuntu, and SUSE issued patches; Red Hat initially deferred a fix before changing guidance to recommend prompt patching alongside the other vendors, The Register reported.
CISA Action
CISA added CVE-2026-31431 to its Known Exploited Vulnerabilities catalog on May 1, 2026, citing evidence of active exploitation in the wild, The Hacker News reported. The agency described the bug in its catalog entry as an “incorrect resource transfer between spheres vulnerability that could allow for privilege escalation,” and set a May 15 remediation deadline for Federal Civilian Executive Branch agencies. Microsoft’s Defender Security Research team noted that “the attack vector is local (AV:L) and requires low privileges with no user interaction,” in remarks cited by The Hacker News.
Google-owned security firm Wiz, which analysed the bug, said it “enables attackers to inject code into privileged binaries…and thereby gain root privileges,” The Hacker News reported.
Why It Matters
Local privilege escalation flaws cannot be exploited remotely on their own, but they are routinely chained with remote-code-execution bugs to escalate from an initial foothold to full system control. The Register flagged multi-tenant systems, shared-kernel containers, continuous-integration runners that execute untrusted code, and Kubernetes clusters as the environments most exposed to Copy Fail, in its analysis. Because the four-byte write lands in the page cache rather than on disk, file-integrity tools that watch for write events through inotify will not see the modification.
Copy Fail is also notable as a kernel bug surfaced with help from an AI code-analysis tool. Theori said it found the issue using its Xint Code platform after about an hour of scanning the Linux crypto/ subsystem, according to BleepingComputer.
What We Don’t Know
Neither CISA nor the cited reporting publicly identifies the threat actors observed exploiting Copy Fail or the targets that triggered the KEV listing. The full extent of in-the-wild use, and whether any breach has already been attributed to the bug, has not been disclosed.