Critical Linux Kernel Flaw 'CopyFail' Grants Root Access Across Distributions
A local privilege escalation bug in the kernel's crypto API enables compromise of multi-tenant environments and CI/CD workflows, with patches available but widely unpatched.
Security researchers from Theori have publicly released exploit code for a critical Linux kernel vulnerability, dubbed CopyFail and tracked as CVE-2026-31431. This local privilege escalation flaw allows unprivileged users to gain root access on virtually all Linux distributions, creating a significant risk for data centres and personal devices. Although patches were issued for specific kernel versions, many systems remain vulnerable because distributions had not yet incorporated the fixes at the time of the public disclosure.
The vulnerability stems from a logic flaw in the kernel's crypto API, specifically within the authencesn AEAD template process used for IPsec extended sequence numbers. The error occurs when data is not copied correctly to the destination buffer, allowing attackers to overwrite memory beyond the legitimate output region. A single Python script released by Theori successfully demonstrated root access on Ubuntu 22.04, Amazon Linux 2023, SUSE 15.6, and Debian 12, proving the exploit works reliably across different distributions without modification.
The severity of the threat lies in its ability to collapse security boundaries in shared infrastructure. An attacker who already possesses some code execution capability, even as a low-privilege user, can promote themselves to root. From this position, they can read every file, install backdoors, and pivot to other systems. This capability enables attackers to compromise multi-tenant environments, break out of containers based on Kubernetes, and hijack CI/CD workflows by creating malicious pull requests.
The disclosure has drawn criticism for a lack of coordination between the researchers and Linux vendors. The team patched the vulnerability in several kernel versions, including 7.0, 6.19.12, and others, but few distributions had incorporated those fixes when the exploit was released. Experts note that while Theori listed affected vendors in their writeup, they failed to verify if those vendors had actually released patches before publishing the exploit code.
Distributions known to have patched the vulnerability include Arch Linux and RedHat Fedora. Other distributors provide useful mitigation guidance, and individuals are advised to check with their respective vendors for the status of their systems. The researchers discovered the flaw after finding underexplored surface area in the crypto subsystem, using an AI-powered tool to identify the bug after approximately an hour of scan time.
This incident highlights the persistent gap between patch availability and widespread deployment in the Linux ecosystem. Previous notable Linux kernel vulnerabilities, such as Dirty Pipe from 2022 and Dirty Cow from 2016, were actively exploited in the wild, and CopyFail is viewed by some experts as one of the worst make-me-root vulnerabilities in recent times. The realistic threat chain involves an attacker exploiting a known vulnerability to gain initial shell access, then using the CopyFail exploit to elevate privileges and take control of the entire host.
