Linux Copy Fail Flaw: CVSS 7.8, Root in Seconds [2026]

A Linux kernel bug patched in late April 2026 can take a normal, unprivileged local account to full root access in a matter of seconds. Security researchers at Theori found it, gave it the name Copy Fail, and it now carries the identifier CVE-2026-31431 with a CVSS v3.1 base score of 7.8. Within days, CERT-EU, Microsoft’s Security Response Center, Red Hat, Ubuntu and half a dozen other vendors had published their own advisories. The flaw sits inside the AF_ALG cryptographic interface, a corner of the kernel most system administrators have never had to think about, let alone patch under pressure.

The story matters beyond one CVE number. Copy Fail is the third major Linux privilege-escalation bug in a decade to hinge on how the kernel handles the page cache. Dirty COW did it in 2016. Dirty Pipe did it in 2022. Now Copy Fail has done it again in 2026, on a kernel that runs more than 90% of the public cloud, according to Linux Foundation training data. It’s part of a broader run of cybersecurity threats this year. This piece breaks down what Copy Fail actually does, which distributions are exposed, how it compares to its two famous predecessors, and what it signals about Linux kernel security six years into a pattern nobody has managed to break.

·

Google · Preferred Sources

Don't miss new tech stories on Google

Add Tech Insider once in the Google app and our stories appear in your news suggestions.

Add Now

What Is the Linux Copy Fail Vulnerability (CVE-2026-31431)?

Copy Fail is a local privilege escalation flaw in the Linux kernel’s cryptographic subsystem, specifically in the algif_aead module that exposes kernel crypto operations to userspace through the AF_ALG socket family. CERT-EU published its advisory on April 29, 2026, calling it a high-severity local privilege escalation vulnerability. Red Hat says it was already aware of the issue by April 25, 2026, and that fixes are now available across its supported branches.

The National Vulnerability Database lists CVE-2026-31431 with a CVSS v3.1 base score of 7.8, the exact rating carried by Dirty Pipe before it (Dirty COW’s NVD score was 7.0). A 7.8 score sounds moderate next to the 9.8 and 10.0 scores common in remote code execution bulletins, but that number reflects one detail: Copy Fail requires local access to exploit. Once an attacker has any foothold on a machine, whether through a compromised web app, a malicious container image, or a low-privilege shell account, the flaw turns that limited access into full root control.

Sysdig’s research team reported that the exploit chain, once triggered, hands an attacker root privileges within seconds. That speed is what pushed the bug from a routine kernel patch into a story covered by CERT-EU, Microsoft and most major Linux vendors within roughly 72 hours of disclosure.

Inside the Flaw: How a 4-Byte Write Becomes Root Access

The technical root cause lives in how the kernel handles data passed through splice() into an AF_ALG socket. According to research published by Sysdig and corroborated by multiple vendor advisories, a logic and memory-handling flaw in algif_aead lets an unprivileged local process trigger a controlled 4-byte write into the page cache backing a file the attacker can only read, not write.

Four bytes sounds trivial. It isn’t. An attacker who can write even a handful of controlled bytes into the page cache of a file like a setuid binary can corrupt just enough of that file to change its behavior, without ever holding write permission on disk. Chain that against the right binary and the result is a full jump from a standard user account to root.

The structure echoes what made Dirty Pipe dangerous in 2022. The flaw isn’t in file permissions or access control checks. It’s in the plumbing that connects the page cache to userspace I/O primitives like splice() and AF_ALG sockets. Traditional permission models never get a chance to say no, because the kernel itself is tricked into treating the write as legitimate.

Timeline: How Copy Fail Went From Private Report to Public Alert

Red Hat’s security team says it was aware of the issue by April 25, 2026. CERT-EU’s public advisory landed four days later, on April 29, 2026, the date most vendors now cite as the official disclosure. Microsoft’s Security Response Center published its own analysis by May 1, 2026, warning that the flaw affects multiple major Linux distributions running in Azure and beyond.

That’s a tight window. Four days between an initial vendor heads-up and a coordinated public advisory is fast by kernel-patching standards, and it suggests Theori’s researchers worked directly with distribution maintainers before going public rather than a bug dropping cold. Fixes shipped in kernel 7.0, along with backports to the 6.19.12 and 6.18.22 stable branches, in the same week.

The speed cuts both ways. A fast, coordinated disclosure gives defenders a head start. It also means the technical details, and in this case working proof-of-concept code, reached the public domain almost as quickly as the patches did. GitHub now hosts multiple public repositories demonstrating the exploit chain, which security teams should treat as confirmation that any unpatched system is one download away from a working attack.

Which Linux Distributions and Kernel Versions Are Affected

Copy Fail’s reach is unusually broad for a single kernel CVE. Microsoft’s advisory lists Ubuntu, Red Hat Enterprise Linux, Debian, SUSE, Amazon Linux, Fedora and Arch Linux among the affected systems, and Splunk’s detection guidance adds AlmaLinux to that list. Because the flaw lives deep in shared upstream kernel crypto code rather than in a distro-specific patch or package, essentially every mainstream Linux distribution shipping a kernel in the affected range needed its own fix.

LTS Kernel Branches Carry the Real Exposure

Reported affected kernel versions span from 4.14 up through the 7.0 release candidates, according to one vendor writeup, while Sysdig’s research flags vulnerable backports specifically in the 6.12.x, 6.6.x, 5.15.x and 5.10.x long-term support lines. That LTS detail matters more than the headline version range. Enterprise Linux shops rarely run bleeding-edge kernels. They run LTS branches for years at a time, precisely the branches Sysdig says were exposed.

Ubuntu’s advisory offers the clearest before-and-after picture: Ubuntu 24.04 LTS shipped a kernel vulnerable to Copy Fail before patching, while Ubuntu 26.04 “Resolute” was built on a kernel released after the upstream fix and was never exposed. Red Hat’s guidance lists RHEL 10.1 among the affected releases pre-patch, with the vendor now saying fixes are available across supported branches.

Distribution	Pre-Patch Status	Patch Status (Early May 2026)
Ubuntu	24.04 LTS and earlier kernels vulnerable	Fixed. 26.04 “Resolute” shipped after the upstream fix and was never exposed
Red Hat Enterprise Linux	RHEL 10.1 listed among affected releases	Red Hat rates it “Important” and says fixes are available across supported branches
Debian	Listed as affected by Microsoft and Splunk	Kernel updates carrying the fix released
SUSE	Listed as affected	Patches issued
Fedora	Listed as affected	Patches issued
Amazon Linux	Listed as affected	Patches issued
Arch Linux	Listed as affected	Rolling-release kernel patched
AlmaLinux	Listed as affected (RHEL downstream)	Patches issued following the upstream RHEL fix

Theori’s Discovery and the Race to Patch

Copy Fail carries the name and initial research credit of Theori, a security research firm known for digging into kernel-level memory corruption bugs. Public writeups describe the firm demonstrating full root access from an unprivileged shell in a matter of seconds once the exploit chain was assembled, a detail Sysdig’s blog highlighted as evidence of how little friction stood between finding the bug and weaponizing it.

Coordinated disclosure of a bug this severe usually runs through a private window with the upstream kernel security team and major distribution maintainers before any public advisory goes out. The compressed timeline here, roughly four days between Red Hat’s internal awareness and CERT-EU’s public notice, points to that kind of coordinated process rather than an emergency scramble after a leak. Still, the fact that GitHub proof-of-concept repositories appeared almost immediately after disclosure shows how thin the margin has become between a patch shipping and an exploit going public for high-profile kernel bugs.

Is Copy Fail Being Actively Exploited?

Here the record is less clean than the technical writeups suggest. SafeBreach’s advisory states that Copy Fail was added to CISA’s Known Exploited Vulnerabilities catalog because of active exploitation, and separately notes that a working exploit was already circulating at the time of disclosure. Microsoft, for its part, described itself as actively investigating the vulnerability rather than confirming specific victim organizations.

No security vendor in the public record has named a breached company or published a forensic case study tied to Copy Fail exploitation, which is a meaningfully different situation from a ransomware crew naming victims on a leak site. What is confirmed: proof-of-concept exploit code sits in public GitHub repositories, the technique requires no special access beyond an existing local foothold, and root is achievable in seconds once the chain runs.

That combination of wide distribution reach, public proof-of-concept code and a low technical bar is exactly the profile that turns a kernel bug from a patch-when-convenient item into a patch-this-week item for any security team running shared or multi-tenant Linux infrastructure.

CVSS 7.8 Explained: Why the Score Undersells the Real Risk

A CVSS score of 7.8 places Copy Fail in the “High” band, one tier below “Critical.” Compare that to the CVSS 10.0 SonicWall SMA bug or the CVSS 9.8 Splunk zero-day that made headlines earlier this year, and Copy Fail looks almost tame by comparison. That comparison misses what actually matters for this class of bug.

Remote code execution flaws score higher because they need no existing access at all. An attacker just needs a network path to the target. Local privilege escalation bugs like Copy Fail score lower under the CVSS formula precisely because they require some existing foothold first. In real-world attack chains, though, that distinction collapses fast. Phishing, a leaked credential, a vulnerable web app or a malicious container image are all common, cheap ways to get that initial foothold. Copy Fail is the second stage that turns any of those low-privilege entry points into total system control, similar in spirit to how a CVSS 7.8 Windows Defender flaw disclosed earlier this year became a springboard for ransomware crews rather than a standalone threat.

Security teams that triage purely by CVSS number risk deprioritizing exactly the bugs that make every other breach worse. A 7.8 local privilege escalation bug sitting unpatched next to a phishing-prone workforce is arguably a bigger practical risk than an isolated 9.8 flaw on a system nobody can reach from the internet.

Copy Fail vs. Dirty COW vs. Dirty Pipe: Comparing Linux’s Worst Kernel Bugs

Copy Fail isn’t a new kind of problem. It’s the third act of a pattern that has now played out in 2016, 2022 and 2026, roughly once every six years. Each bug found a different way into the same weak point: the boundary between the page cache and userspace I/O.

Dirty COW, discovered by researcher Phil Oester and disclosed as CVE-2016-5195, exploited a race condition in how the kernel handled copy-on-write memory. NVD and SUSE both confirmed it was already being exploited in the wild by October 2016, and later analysis traced the underlying bug back to Linux kernel 2.6.22, meaning it sat undiscovered in production systems for roughly nine years before anyone caught it.

Dirty Pipe, found by developer Max Kellermann and disclosed as CVE-2022-0847 on March 7, 2022, came from a different angle: an improperly initialized pipe buffer flag that let a local user overwrite page-cache-backed read-only files. Copy Fail’s mechanism, the controlled 4-byte write via AF_ALG and splice(), is its own distinct bug. But it reaches the same destination Dirty COW and Dirty Pipe both reached: an unprivileged user corrupting page-cache content to fake their way into root.

Two of the three carry a CVSS score of 7.8; Dirty COW’s NVD-listed CVSS v3.1 base score is actually 7.0. That’s less a coincidence of formula quirks than a signal that this specific category, local kernel memory corruption via the page cache, consistently lands in the same severity band even as the exact technique evolves.

Vulnerability	CVE	Disclosed	CVSS v3	Discovered By	Mechanism
Dirty COW	CVE-2016-5195	2016	7.0	Phil Oester	Race condition in copy-on-write handling allows a write to a read-only memory mapping
Dirty Pipe	CVE-2022-0847	March 7, 2022	7.8	Max Kellermann	Stale pipe buffer flags allow overwriting page-cache-backed read-only files
Copy Fail	CVE-2026-31431	April 29, 2026	7.8	Theori	AF_ALG/splice() logic flaw enables a controlled 4-byte write into the page cache

Market Impact: What Copy Fail Means for Cloud and Hosting Infrastructure

More than 90% of the public cloud runs on Linux, according to Linux Foundation training data, which is the number that turns a single kernel CVE into an industry-wide event rather than a niche advisory. Every major hyperscaler, plus the entire tier of managed hosting and VPS providers beneath them, runs some mix of the distributions named in Copy Fail’s advisories.

Multi-tenant environments are where local privilege escalation bugs do the most damage. On a shared host, container platform, or VPS node, the attacker doesn’t need to breach the perimeter from the outside. They just need one tenant-level foothold, a compromised container, a vulnerable application, a malicious package, and Copy Fail becomes the bridge from that limited blast radius to full host control. That’s a materially different threat model than a single-tenant server where an attacker already needs a much harder initial break-in.

No security vendor has published a dollar-figure damage estimate for Copy Fail specifically, and this article won’t invent one. What’s measurable instead is exposure surface: eight or more mainstream distributions, LTS kernel branches that enterprises run for years, and a public exploit chain that reaches root in seconds. For cloud and hosting providers, that combination is why Copy Fail got emergency-patch treatment rather than a routine changelog entry.

How Red Hat, Ubuntu, SUSE and Microsoft Responded

Red Hat classified the issue as “Important” severity and says fixes are now available across all supported branches, a designation one notch below Red Hat’s top “Critical” tier but still treated as a priority patch. Ubuntu’s security team published a dedicated advisory confirming fixes were available and clarifying that its newest release, 26.04 “Resolute,” shipped on a kernel built after the upstream patch landed, meaning it was never exposed in the first place.

Microsoft’s involvement stands out because Copy Fail isn’t a Windows bug. The company’s Security Response Center published its own analysis on May 1, 2026, warning customers running Linux workloads on Azure that the flaw affects multiple major distributions. That’s a reflection of how much Linux now underpins Microsoft’s own cloud business, not a courtesy notice.

SUSE, Fedora, Arch Linux, Amazon Linux and AlmaLinux all shipped their own patches in the same window, according to vendor tracking from Splunk and Microsoft. The pattern across every vendor response stayed consistent: acknowledge quickly, patch quickly, and point customers toward kernel upgrades rather than workarounds, since the flaw sits too deep in shared kernel code for a simple configuration change to neutralize it.

The Bigger Pattern: Local Privilege Escalation in the Multi-Tenant Cloud Era

Local privilege escalation bugs used to be a secondary concern behind remote code execution. That ranking made sense when most servers were single-purpose boxes with a small number of trusted local users. It makes much less sense in 2026, when a single physical host might run dozens of containers, each controlled by a different customer or team, all sharing one kernel.

Containers, by design, share the host kernel rather than running their own. That means a kernel-level local privilege escalation bug like Copy Fail can, in the wrong configuration, let an attacker break out of a single container’s limited privileges and reach the host itself, threatening every other tenant on that machine. Kubernetes clusters, shared CI/CD runners and budget VPS hosting all carry this exposure pattern to varying degrees.

This is why Copy Fail landed on the desks of security teams who don’t think of themselves as kernel specialists. Platform engineers, DevOps teams and cloud security architects all inherited this bug the moment their infrastructure touched an affected distribution, regardless of whether they had ever heard of AF_ALG before April 2026.

How to Patch and Mitigate Copy Fail Today

The fix is a kernel upgrade, not a configuration change. Every major distribution named in this article has shipped a patched kernel, and the practical remediation path stays the same across all of them: update to the fixed kernel version, reboot to load it, and verify the running kernel matches or exceeds the patched release for that distribution.

Checking Your Kernel Version

A simple version check is the fastest way to confirm exposure before rolling out a fleet-wide patch:

uname -r
# Compare the output against your distro's patched kernel release

# RHEL / AlmaLinux
rpm -q kernel | sort -V | tail -1

# Debian / Ubuntu
apt list --installed 2>/dev/null | grep linux-image

# SUSE
zypper se -i kernel-default

For environments that can’t reboot immediately, restricting access to the AF_ALG socket family through seccomp profiles or kernel module blacklisting can reduce exposure, though every vendor advisory treats this as a stopgap rather than a fix. Container platforms should prioritize host-level kernel patching over per-container mitigation, since the vulnerability lives below the container boundary entirely. Cloud customers running unmanaged VPS or IaaS instances carry the patching responsibility themselves, unlike managed PaaS customers whose provider handles the host kernel.

What This Means for DevOps and Platform Security Teams

Copy Fail is a reminder that kernel-level patching discipline hasn’t kept pace with how fast infrastructure has moved toward containers and shared multi-tenancy. A bug in a kernel module most engineers have never configured directly, AF_ALG, ended up as a same-week patch priority for cloud teams, hosting providers and enterprise Linux shops simultaneously.

Teams that treat kernel updates as a quarterly maintenance chore rather than a security control got caught flat-footed by the four-day gap between Red Hat’s internal awareness and public disclosure. Teams with automated kernel patching pipelines, or at minimum a fast manual escalation path for CISA KEV-tagged bugs, had a real head start.

The practical takeaway for platform teams is to treat local privilege escalation bugs in shared-kernel environments with the same urgency normally reserved for remote code execution. The CVSS score alone won’t tell that story, since a 7.8 rating on paper and root access in seconds on a multi-tenant host can describe the exact same bug.

5 Predictions for Linux Kernel Security After Copy Fail

• More AF_ALG and crypto-subsystem scrutiny. Expect independent researchers to comb through other kernel crypto interfaces for similar logic flaws now that Copy Fail has demonstrated the technique works, following the same pattern that hit splice()-adjacent code after Dirty Pipe surfaced in 2022.
• Faster distro patch cycles for KEV-tagged bugs. With SafeBreach reporting Copy Fail’s addition to CISA’s Known Exploited Vulnerabilities catalog, expect major distributions to keep compressing the gap between an upstream fix and downstream package availability, building on the roughly one-week turnaround seen this time.
• Container platforms will push harder on kernel isolation. Expect renewed vendor interest in user-space kernels, Kata Containers and other sandboxing approaches that limit how much of the host kernel a compromised container can actually reach, specifically because bugs like Copy Fail bypass container boundaries entirely.
• Bug bounty payouts for kernel LPE research will keep climbing. As multi-tenant cloud exposure grows, expect platforms and vendors to raise rewards for local privilege escalation research, since the practical damage from LPE bugs in shared infrastructure now rivals many remote code execution bugs.
• Expect a fourth page-cache bug within the decade. Given the six-year rhythm between Dirty COW, Dirty Pipe and Copy Fail, and the sheer size and complexity of the kernel’s memory management code, betting against a fourth major page-cache-adjacent privilege escalation bug before 2032 would be unwise.

Frequently Asked Questions

What is CVE-2026-31431?

CVE-2026-31431, nicknamed Copy Fail, is a Linux kernel local privilege escalation vulnerability in the AF_ALG cryptographic interface. It carries a CVSS v3.1 score of 7.8 and lets a local unprivileged user gain root access, according to CERT-EU’s April 29, 2026 advisory.

Which Linux distributions are affected by Copy Fail?

Vendor advisories from Microsoft and Splunk list Ubuntu, Red Hat Enterprise Linux, Debian, SUSE, Amazon Linux, Fedora, Arch Linux and AlmaLinux among the affected distributions. Because the bug lives in shared upstream kernel code, most mainstream distributions running an affected kernel version needed a patch.

Is Copy Fail being exploited in the wild?

SafeBreach’s advisory says Copy Fail was added to CISA’s Known Exploited Vulnerabilities catalog due to active exploitation, and that a working exploit was already circulating at disclosure. Microsoft described itself as investigating the issue. No vendor has published a named victim organization or breach case study tied to Copy Fail as of this writing.

How is Copy Fail different from Dirty COW or Dirty Pipe?

All three are Linux kernel local privilege escalation bugs that share an identical CVSS score of 7.8, and all three involve corrupting page-cache-backed data to escalate privileges. Dirty COW (2016) exploited a copy-on-write race condition, Dirty Pipe (2022) abused stale pipe buffer flags, and Copy Fail (2026) uses a controlled 4-byte write through the AF_ALG interface and splice().

Who discovered Copy Fail?

Security research firm Theori is credited with the discovery. Sysdig’s research team reported that Theori demonstrated full root access from an unprivileged account in seconds once the exploit chain was assembled.

How do I check if my system is patched against Copy Fail?

Run uname -r to check your current kernel version and compare it against your distribution’s published fixed release. Ubuntu, Red Hat, SUSE, Debian, Fedora, Arch, Amazon Linux and AlmaLinux have all published patched kernel versions, and a reboot is required to load the fix after updating.

Does Copy Fail affect containers and Kubernetes environments?

Yes. Containers share the host kernel rather than running their own, so an unpatched host kernel can let an attacker inside one container escalate to root and potentially reach the host or other tenants. Security teams should prioritize host-level kernel patching over per-container mitigations for this specific bug.

What should I do if I can’t patch immediately?

Vendor guidance treats options like restricting AF_ALG access through seccomp profiles or kernel module blacklisting as temporary stopgaps, not substitutes for patching. Given that public proof-of-concept exploit code already circulates and CISA has flagged active exploitation, security teams should prioritize scheduling the kernel update and reboot as soon as possible rather than relying on mitigations long-term.

Related Coverage

• Splunk Zero-Day: CVSS 9.8, 3-Day CISA Deadline [2026]
• SonicWall Zero-Days: CVSS 10.0 Bug Exploited 22 Days [2026]
• BlueHammer: CVSS 7.8 Defender Bug Fuels Ransomware [2026]
• Microsoft Patches Record 570 CVEs, 2 Zero-Days [2026]
• Windows Netlogon Flaw Beats Zerologon: CVSS 9.8 [2026]
• Tenable vs Qualys vs Rapid7: $15K-$500K Price Gap [2026]