copy fail: a 732-byte script gets root on major linux distributions

what happened

• Copy Fail (CVE-2026-31431), publicly disclosed April 29, 2026, is a flaw in the kernel's algif_aead (AF_ALG) crypto interface that lets an unprivileged local user make a controlled 4-byte write into the page cache of any readable file.[1,4,5]
• The researchers' demo alters the in-memory copy of /usr/bin/su to get root, and the same script ran unmodified on Ubuntu 24.04, Amazon Linux 2023, RHEL 10.1 and SUSE 16.[1]
• The on-disk file is not changed, so integrity checks that compare against disk can miss the modification.[1,5]
• The NVD record lists a 7.8 score (CVSS v3.1, AV:L/AC:L/PR:L) from two secondary scorers and fixed stable kernels 5.10.254, 5.15.204, 6.1.170, 6.6.137, 6.12.85, 6.18.22 and 6.19.12. The upstream fix is commit a664bf3d603d.[2,1,4]
• CISA added CVE-2026-31431 to its Known Exploited Vulnerabilities catalog on 2026-05-01 with a 2026-05-15 due date.[3,2]
• Because the page cache is shared across the host, the primitive can cross container boundaries, and CERT-EU told organisations to patch Kubernetes nodes and CI/CD runners first.[1,4]
• As of April 30, 2026, CERT-EU said no distribution had yet shipped a fixed kernel package.[4]
• CERT/CC says Theori found the bug with help from its AI-based static analysis tool, and that it cannot be used directly to escape from a virtual machine guest to its host.[5]