A Copy Fail FAQ

On April 29, researchers from Theori disclosed a new Linux bug called Copy Fail that can give an attacker root privileges with very little effort. The bug affects several Linux distros and is present in Linux kernels from as far back as 2017. Copy Fail brought back memories of previous named Linux bugs like Dirty Cow, but it differs in a few key ways from other vulnerabilities. So let’s have a look at what it is and what it’s not.

What is Copy Fail?

It’s a local privilege escalation (LPE) bug (CVE-2026-31431) that affects every Linux kernel compiled since 2017. That’s a lot of kernels. The researchers who discovered Copy Fail tested it against a range of Linux distributions, including SUSE, RHEL, Amazon Linux, and Ubuntu, and found that the same exploit worked against all of them without modification. All the attacker needs is any kind of account on the target machine. 

“It lets an unprivileged local user trigger a deterministic, controlled 4-byte write into the page cache of any readable file on the system. A single 732-byte Python script can edit a setuid binary and obtain root on essentially all Linux distributions shipped since 2017,” the explanation says. 

“The kernel never marks the corrupted page dirty for writeback, so the file on disk remains unchanged and ordinary on-disk checksum comparisons miss the modification. However, the page cache is what actually gets read when accessing the file, so the corrupted in-memory version is immediately visible system-wide. A local unprivileged user can turn this into root by corrupting the page cache of a setuid binary.”

That sounds bad. 

That’s not a question.

Sorry. How bad is it?

Like a lot of these things, the answer is, It depends. Obviously, an attacker getting root on your system is suboptimal, and this bug is a simple, portable way to do that. But there are a LOT of ways to do that and there are plenty of other known privilege escalation bugs out there. And if an attacker is on your system exploiting this vulnerability, several things have gone wrong already and Copy Fail is just the end result of that chain of events. 

Security researcher Juliano Rizzo, who knows more than almost anyone about nasty crypto bugs, put it succinctly on The Everything App:

“Do not design systems assuming privilege escalation is hard. It never was. Anything local can become root. Every OS has had trivial privesc bugs, and any serious attacker keeps a few. Treat user separation as hygiene; not security. Disposable instances, minimal persistence.”

Still, Copy Fail is a simple, repeatable, portable exploit that gives an attacker complete control of a target Linux box. Not ideal.

Is this a drop-everything-and-patch situation?

It’s probably more in the range of, let’s update affected Linux systems as soon as we can practically do so without disrupting everything. All of the affected Linux distributions have released patches and there is plenty of practical advice on mitigating the bug if patching immediately isn’t an option. SentinelOne has the following recommendations:

• Restrict access to the AF_ALG socket interface using kernel configuration or security modules if immediate patching is not feasible
• Apply SELinux or AppArmor policies to limit which processes can access the cryptographic socket interface
• Consider disabling the algif_aead module if AEAD socket operations are not required in your environment

At least this wasn’t found by Claude Mythos. Right?

Right! But it was found with the assistance of AI. The team at Theori that discovered the issue said the initial work of mapping the attack surface and other prep was done by Taeyang Lee. But then AI eventually discovered the Copy Fail bug. 

Is there more to come?

It looks like it. Theori researchers said there’s a second part to this research that involves a Kubernetes container escape, but there aren’t any details available on that yet.

Aren’t we done branding bugs?

Nope! Although none of the Mt. Rushmore branded bugs are in danger of being chiseled off the mountain anytime soon. 

Wait, there's Mt. Rushmore of branded bugs?

So glad you asked! There sure is, and it’s located on a mountainside of crumbling sandstone overlooking Silicon Valley. Here are the current members:

• BEAST. The OG. Insane work by the aforementioned Rizzo and Thai Duong.
• Heartbleed. A very nasty bug that taught the infosec community how to panic.
• Rowhammer. Cool DRAM attack that sounds like a rad ‘80s punk band.
• Meltdown. Along with Spectre, a slick sidechannel speculative execution attack. Spectre has a cooler logo, but loses points for being named after the worst modern James Bond movie. 

What about Stuxnet?

Goodbye.