The 'Copy Fail' vulnerability (CVE-2026-31431) is a high-severity logic bug in the Linux kernel's authencesn AEAD template used by IPsec for Extended Sequence Number support. Introduced in 2017, it affects all Linux distributions by placing page cache pages in a writable scatterlist and using the caller's destination scatterlist as scratch space. During cryptographic operations, a write of four bytes occurs past the AEAD tag boundary into the cached copy of another file. This allows an attacker with local code execution to modify the in-memory page cache of any setuid-root binary readable by the user, resulting in root shell access. The vulnerability differs from Dirty Pipe and Dirty Cow by modifying memory without altering the file on disk. Exploitation is achievable with a small Python script. The vendor patches remove the problematic optimization, reverting to out-of-place operations and unlinking page cache pages from writable scatterlists.

Successful exploitation allows local attackers to escalate privileges to root by modifying in-memory cached copies of setuid-root binaries without changing files on disk. This leads to full system takeover, especially in environments with shared kernels such as multi-tenant Linux hosts, containers, and CI runners. The vulnerability undermines kernel memory isolation and can result in node and cross-tenant compromises. No known exploits in the wild have been reported at the time of disclosure.

Fixed versions of the Linux kernel have been released that remove the 2017 optimization responsible for the vulnerability by reverting to out-of-place operations and unlinking page cache pages from writable scatterlists. Organizations should update their Linux distributions to these patched versions as soon as possible, particularly in multi-tenant, containerized, or CI environments running untrusted code. Since this is a kernel-level flaw, applying the official kernel patches is the primary mitigation. Patch status is confirmed by vendor advisories and security researchers. No alternative mitigations or workarounds are indicated.