Chris Grant (he/him) May 01, 2026 A 5 minute read

Copy Fail (CVE-2026-31431): What It Is and What You Should Do

A new Linux kernel vulnerability has been making headlines across the security world. Named “Copy Fail” and tracked as CVE-2026-31431, it affects virtually every major Linux distribution released since 2017 and lets an unprivileged user gain full root access using a tiny script.

If your business runs Linux servers, cloud infrastructure, or any Linux-based systems, here is what you need to know.

What Is Copy Fail?

Copy Fail is a logic flaw buried in the Linux kernel’s cryptographic code. It sits in a module called algif_aead, which handles a type of encrypted socket used by the kernel’s cryptography interface.

The bug was discovered by Theori researcher Taeyang Lee and turned into a working exploit by the Xint Code Research Team, with help from AI-assisted analysis.

What makes it particularly serious is how reliable it is. Unlike many kernel exploits that require precise timing or repeated attempts to win a “race condition”, Copy Fail works in a straight line. There is no race to win. The same script works on the same system every time, and across almost every tested Linux distribution and architecture.

How Does It Work?

The flaw stems from the way three separate kernel changes interact. Each change was made years apart:

  • The authencesn cryptographic template was added in 2011
  • AF_ALG AEAD socket support arrived in 2015
  • An in-place optimisation was added to algif_aead.c in 2017

Together, these changes create a path that lets a local unprivileged user trigger a controlled 4-byte write into the kernel’s page cache, which is the in-memory copy of files on disk.

By targeting a privileged binary (such as a setuid program), an attacker can silently modify that binary in memory without touching the file on disk. The result: root access.

The proof-of-concept exploit is a 732-byte Python script, just ten lines of code.

Who Is Affected?

This affects Linux systems running a kernel compiled with authencesn support, which is the default configuration on most major distributions. Affected systems include:

  • Ubuntu
  • Red Hat Enterprise Linux (RHEL)
  • Amazon Linux
  • SUSE
  • Most other mainstream Linux distributions shipped since 2017

The vulnerability requires local access to exploit. A remote attacker would need to have already gained some foothold on the system before they could use this. That said, once they have any local access, gaining root is trivial.

How Severe Is It?

CVE-2026-31431 carries a CVSS score of 7.8, placing it in the “high” severity band. It is a local privilege escalation flaw, meaning it does not give attackers remote access by itself, but it is a powerful tool once any level of access is established.

Security researchers have compared it to Dirty Cow and Dirty Pipe, two other well-known Linux kernel exploits. Copy Fail is considered more dangerous than both because it is entirely deterministic and requires no timing tricks.

What Is the Timeline?

  • 23 March 2026: Reported to the Linux kernel security team
  • 1 April 2026: Patch committed to the mainline kernel
  • 22 April 2026: CVE assigned
  • 29 April 2026: Public disclosure

What Should You Do?

The good news is that patches are already available. Most major distributions have released or are releasing updated kernel packages.

Here is what to prioritise:

  • Update your kernel packages as soon as possible on all Linux systems
  • Check with your cloud or hosting provider to confirm whether managed instances have been patched
  • If you cannot patch immediately, a temporary workaround is to blacklist the algif_aead kernel module
  • Review who has local access to your Linux systems; this attack requires local access first

For businesses running managed hosting or cloud infrastructure, your provider should be issuing updates. If you are unsure whether your systems are affected, get in touch and we can help you assess your exposure.

A Note for Small Businesses

You may not run Linux servers directly, but many businesses rely on them without realising it. Linux powers a large proportion of the web, including most cloud hosting, WordPress servers, and managed platforms.

If your website or business systems sit on a Linux server, your hosting provider is responsible for applying this patch. It is worth checking in with them or your IT support team to confirm the update has been applied.

Security vulnerabilities like Copy Fail are a good reminder of why keeping software up to date matters. Not just your laptop or phone, but the servers your business depends on every day.

Need Help?

If you are unsure whether your business infrastructure is affected, or you want a straightforward review of your hosting security setup, O’Brien Media can help. We work with small businesses to make sure their digital foundations are solid.

Get in touch at [email protected].

Frequently Asked Questions

Is my website at risk from Copy Fail? If your website runs on a Linux server (which most do), it depends on whether your hosting provider has applied the patch. The vulnerability requires local access to exploit, so a visitor to your website cannot use it directly. However, if a server were already compromised in another way, Copy Fail could be used to escalate that access. Check with your host to confirm the patch has been applied.

Do I need to do anything on my Windows or Mac computer? No. Copy Fail only affects Linux systems. Your personal Windows or Mac device is not at risk from this specific vulnerability.

What does “local access” mean? It means the attacker needs to already be logged into the system, either directly or via SSH, before they can use this exploit. Someone browsing your website from the internet cannot trigger it remotely.

Has Copy Fail been used in real attacks? As of public disclosure on 29 April 2026, there are no confirmed reports of active exploitation. However, now that a proof-of-concept is public, the risk of attacks increases. Patching quickly is the best response.

What is the temporary workaround if I cannot patch yet? You can blacklist the algif_aead kernel module. This disables the vulnerable component without requiring a full kernel update. Your system administrator or hosting provider can apply this. Note that it is a temporary measure, not a permanent fix.

How do I know if my hosting provider has patched this? Contact your provider directly and ask whether they have applied the fix for CVE-2026-31431. Most major cloud and managed hosting providers will have already done so or will have a published security advisory.

What is a CVSS score of 7.8? The Common Vulnerability Scoring System (CVSS) rates vulnerabilities from 0 to 10. A score of 7.8 falls in the “high” band. It is serious, but not rated “critical” (9.0+) because it requires local access rather than being remotely exploitable.