CopyFail Linux Vulnerability Enables Root Access Exploits
Exploit code for a major unpatched flaw granting root privileges on nearly all Linux versions has triggered widespread alerts. Security firm Theori published the code on Wednesday evening, weeks after notifying the Linux kernel team privately. Defenders now rush to protect data centers and personal machines from potential attacks.
The Linux kernel team applied fixes to versions 7.0, 6.19.12, 6.18.12, 6.12.85, 6.6.137, 6.1.170, 5.15.204, and 5.10.254. However, at the time of release, most Linux distributions had not integrated these patches.
Single Script Attacks All Major Distributions
Tracked as CVE-2026-31431 and dubbed CopyFail, this local privilege escalation lets regular users gain administrator rights. Its danger lies in a universal exploit: one Python script that requires no changes to hit vulnerable systems.
The script succeeds on Ubuntu 22.04, Amazon Linux 2023, SUSE 15.6, and Debian 12. Schrijvershof noted why this matters for shared setups. In 2026, local access spans containers on Kubernetes nodes, tenants on hosting servers, CI/CD jobs with untrusted code, WSL2 on Windows, and containerized AI agents with shell access. All share the kernel, so this flaw erases those walls.
A typical attack path: exploit a WordPress plugin for www-data shell access, run the CopyFail proof-of-concept, gain root on the host, and reach other tenants, as shown in a hack post-mortem.
Flaw Originates in Kernel Crypto Logic
The issue arises from a direct logic error in the kernel's crypto API. The authenc AEAD template process for IPsec extended sequence numbers fails to copy data properly. It uses the caller's buffer as scratch space, writes 4 bytes beyond the valid area, and does not reset them. Thus, the AAD ESN bytes escape the buffer, earning the name CopyFail.
Unlike race conditions or memory bugs, this logic flaw ensures consistent results across kernels and distributions. Bugcrowd researchers observed, "reliability isn't probabilistic, and the same script works across distributions. No race window, no kernel offset."
Linux powers most servers worldwide, Android devices, supercomputers, and cloud infrastructure. The kernel, maintained openly since 1991 by Linus Torvalds and contributors, handles core functions like process management and hardware interaction.
Stay ahead of the AI curve
The most important updates, news, and content — delivered weekly.
No spam. Unsubscribe anytime.
Experts Call It Worst in Years, Slam Disclosure
Security professionals view CopyFail as among the gravest root-granting kernel flaws lately. It rivals Dirty Pipe from 2022 and Dirty Cow from 2016, both exploited actively in attacks.
Distributions often use older kernels and backport fixes. Theori disclosed to the kernel team but not vendors, per available details. With public exploits before distro patches, it mimics a zero-day, or more precisely, a zero-day patch gap.
Will Dormann, senior principal vulnerability analyst at Tharros Labs, criticized the process. "The org doing the disclosure… did an absolutely terrible job of vulnerability coordination. What is mind boggling to me is that in their writeup they both: A) list 4 affected vendors, and B) tell readers to apply vendor patches. But before firing away with the publication, they didn't bother to see if ANY of the vendors that they list ACTUALLY HAVE PATCHES. (None do)."
Theori did not comment on requests.
Arch Linux and Red Hat Fedora have issued patches. SUSE, Red Hat, and Ubuntu provided mitigation advice at publish time. Users should consult vendors for others.
Discovery and Urgent Response Steps
Theori's Taeyang Lee spotted potential in the crypto subsystem, particularly splice() handling page-cache and scatterlist pages. Their AI-powered Xint tool detected the bug in about an hour. Theori also built an exploit to escape Kubernetes containers using CopyFail.
Kubernetes, an open-source platform from the Cloud Native Computing Foundation since 2014, orchestrates containers at scale for applications.
Given the high exploitation risk, all Linux users must check systems now. Follow distributor guidance or Schrijvershof's post for mitigations.
CI/CD workflows automate code building and deployment, vital in DevOps practices across tech firms.