Linux kernel vulnerability dubbed CVE-2026-31431 affects major distributions released since 2017
The Facts
- Researchers disclosed a Linux kernel local privilege-escalation vulnerability tracked as CVE-2026-31431 and referred to as “Copy Fail.”
- Multiple reports say the vulnerability affects virtually all or nearly all major Linux distributions released since 2017.
- The flaw allows an unprivileged local user to write four controlled bytes into the page cache of a readable file and use that capability to gain root privileges.
- Sources describe the bug as a logic flaw in the Linux kernel’s cryptographic subsystem, including the algif_aead or related authenticated-encryption code path.
- A public proof-of-concept exploit has been released, and several reports say it can work with a 732-byte Python script across tested distributions without race conditions or per-kernel customization.
- The vulnerability is primarily a risk after an attacker already has local code execution or user-level access, because it can turn limited access into full administrative control.
- Containerized and shared-kernel environments are highlighted as especially exposed because the page cache is shared, raising the possibility of impact beyond a single container or user context.
- Kernel patches have been issued, but reports said at disclosure time that many Linux distributions had not yet shipped those fixes, leaving patch rollout as an immediate next step.
Context
What does this vulnerability let an attacker do?
Reports say CVE-2026-31431 lets an unprivileged local user write four controlled bytes into the page cache of a readable file, which can then be used to make privileged binaries execute in a way that yields root access Free Press Journal,TheRegister.com,Security Affairs.
Who is most affected by the risk?
The flaw matters most on systems where an attacker can already run code locally, such as shared servers, hosting platforms, CI systems, and container hosts; several sources also warn that containers are a particular concern because of shared page cache behavior Security Boulevard,Security Affairs,Linuxiac.
What is the current response?
Researchers disclosed the bug after reporting it to the Linux kernel security team, and multiple sources say kernel fixes are available or being shipped, although some distributions had not yet incorporated them when the exploit became public Ars Technica,Infosecurity Magazi…,DataBreachToday.
How left and right read it
What stands out is how broadly this can expose people who rely on shared systems: reports say it affects nearly all major Linux distributions released since 2017, and shared-kernel or containerized environments are especially exposed. With patches issued but many distributions not yet shipping them at disclosure, the immediate public-interest question is how quickly institutions close a gap that can turn limited access into root control.
The key issue here is how easily a local foothold can be converted into full administrative power: researchers say an unprivileged local user can gain root, and a public proof of concept reportedly works across tested distributions with a 732-byte Python script and no per-kernel customization. That puts the focus on basic access control and disciplined patch rollout, especially since fixes existed while many distributions had not yet shipped them.
The receipts — 24 sources
Independent coverage (24)
The news, read by both sides.
The day’s biggest stories in one short brief, built to show both sides and the competing values behind the headlines. Free in your inbox.