Executive Summary
The 'Copy Fail' vulnerability (CVE-2026-31431) is a critical logic flaw in the Linux kernel's crypto subsystem disclosed by Xint Code. Unlike previous high-profile kernel exploits that relied on race conditions, Copy Fail is a straight-line logic bug that allows an unprivileged local user to perform a controlled 4-byte write into the page cache of any readable file. This enables an attacker to modify the in-memory version of setuid binaries (like /usr/bin/su) to execute arbitrary shellcode as root without changing the file on disk.
The vulnerability is highly portable and has been demonstrated to affect major distributions including Ubuntu 24.04, Amazon Linux 2023, RHEL 10.1, and SUSE 16. Because the page cache is shared across the host, the exploit primitive also functions as a container escape mechanism, potentially allowing a compromise of the underlying host or Kubernetes node from a restricted pod. Systems running Linux kernels shipped since 2017 are likely vulnerable.
Organizations should prioritize patching kernels to the fixed version (e.g., commit a664bf3d603d). Immediate mitigation can be achieved by disabling the AF_ALG socket family or blacklisting the algif_aead kernel module to remove the primary attack surface reachable by unprivileged users.