‘Copy Fail’ Logic Flaw in Linux Kernel Enables System Takeover
Source SecurityWeek
Mentioned vulnerabilities
Rated High by Threat Radar from the SecurityWeek text
Data as of 30 Apr 2026, 10:06 UTC
What to do
AI-suggested
Fixed versions of the Linux kernel have been released that remove the 2017 optimization responsible for the vulnerability by reverting to out-of-place operations and unlinking page cache pages from writable scatterlists. Organizations should update their Linux distributions to these patched versions as soon as possible, particularly in multi-tenant, containerized, or CI environments running untrusted code. Since this is a kernel-level flaw, applying the official kernel patches is the primary mitigation. Patch status is confirmed by vendor advisories and security researchers. No alternative mitigations or workarounds are indicated.
Description
CVE-2026-31431, known as 'Copy Fail,' is a logic flaw in the Linux kernel's authencesn cryptographic template introduced in 2017. It allows local attackers with code execution privileges to write arbitrary code into the in-memory page cache of other files, including setuid-root binaries, enabling privilege escalation to root. The vulnerability affects all Linux distributions since 2017 and poses a significant risk in multi-tenant and containerized environments where shared kernel memory is used. Exploitation does not modify files on disk but alters their in-memory cached copies, making detection harder. The flaw stems from an optimization that placed page cache pages in a writable scatterlist, allowing out-of-bounds writes during byte rearrangement. Patches have been released that revert this optimization to prevent exploitation.