--- title: "CVE-2026-31431: “Copy Fail” Linux kernel flaw lets local users gain root in seconds" url: https://daily.dev/posts/cve-2026-31431-copy-fail-linux-kernel-flaw-lets-local-users-gain-root-in-seconds-1fwozvlkf source_url: https://webflow.sysdig.com/blog/cve-2026-31431-copy-fail-linux-kernel-flaw-lets-local-users-gain-root-in-seconds type: article source: "Sysdig Blog" published: 2026-05-31T07:44:13.575Z updated: 2026-05-31T08:27:21.190Z tags: ["security", "linux"] reading_time: 6 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # CVE-2026-31431: “Copy Fail” Linux kernel flaw lets local users gain root in seconds **[Sysdig Blog](https://daily.dev/sources/sysdig-blog)** · 6 min read · 0 upvotes · 0 comments ## Summary CVE-2026-31431, dubbed 'Copy Fail' (CVSS 7.8), is a Linux kernel local privilege escalation flaw in the algif_aead userspace crypto interface, present since a 2017 in-place optimization commit. An unprivileged local user can corrupt the page cache backing setuid binaries (e.g., /usr/bin/su) via AF_ALG sockets and splice(), gaining root in seconds. Working exploits exist for Ubuntu 24.04, Amazon Linux 2023, RHEL 10.1, and SUSE 16. The public PoC is a ~700-byte Python script chaining three syscalls. Unlike Dirty Pipe, this is a straight-line logic flaw with no race conditions. Fixes are available in Linux 7.0, 6.19.12, and 6.18.22. Mitigations include patching, restricting AF_ALG socket creation via seccomp, and deploying the provided Falco detection rule. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Copy Fail — CVE-2026-31431](https://daily.dev/posts/copy-fail-cve-2026-31431-ippi6vm9m) · Hacker News · 1 upvotes · 1 comments --- Tags: [#security](https://daily.dev/tags/security), [#linux](https://daily.dev/tags/linux) [View this post on daily.dev](https://daily.dev/posts/cve-2026-31431-copy-fail-linux-kernel-flaw-lets-local-users-gain-root-in-seconds-1fwozvlkf)