CopyFail (CVE-2026-31431): What You Need to Know and How to Protect Your Infrastructure

What Is CopyFail?

CopyFail (CVE-2026-31431) is a local privilege escalation vulnerability in the Linux kernel's cryptographic subsystem. It allows any unprivileged local user to gain full root access on affected systems — deterministically, without race conditions, and using a tiny 732-byte Python script that works unchanged across distributions.

The vulnerability was introduced in 2017 by an optimization in algif_aead.c and affects every Linux kernel version from 4.14 through 6.19.12. That means Ubuntu, RHEL, Debian, SUSE, Amazon Linux, Fedora, and essentially every Linux distribution deployed in production today has been vulnerable for almost a decade.

How CopyFail Works

CopyFail exploits the kernel's AF_ALG (crypto API) interface to perform controlled 4-byte writes directly into the page cache of readable files. The attack flow is straightforward:

1. The attacker opens a readable setuid binary (like /usr/bin/sudo or /usr/bin/passwd) through the AF_ALG interface
2. The kernel's AEAD (Authenticated Encryption with Associated Data) implementation contains a flaw in how it handles output buffers
3. The attacker triggers a controlled 4-byte write into the page cache — the kernel's in-memory copy of the file
4. By corrupting specific bytes of the setuid binary in memory, the attacker can redirect execution flow
5. When any user (or the attacker themselves) executes the corrupted setuid binary, the attacker's code runs as root

Why CopyFail Is Especially Dangerous for Infrastructure

Unlike many kernel vulnerabilities that require specific configurations or timing, CopyFail is uniquely dangerous because of its reliability and stealth:

Who Is Most at Risk?

• Multi-tenant cloud environments — any tenant with local access can escalate to root
• Kubernetes clusters — container escape becomes trivial once root is obtained on the host kernel
• CI/CD runners — build jobs with local access can compromise the entire runner fleet
• Shared development servers — any developer account can escalate to root
• Bastion hosts — the single point of access becomes the single point of compromise

Affected Systems

Immediate Mitigation Steps

If you cannot patch immediately, you can mitigate CopyFail by disabling the vulnerable kernel module:

# Disable the algif_aead module
echo "install algif_aead /bin/true" | sudo tee /etc/modprobe.d/copyfail.conf

# Unload if currently loaded
sudo modprobe -r algif_aead 2>/dev/null

This prevents the AF_ALG AEAD interface from being loaded. Most server workloads don't use this module directly — it's primarily used by user-space cryptographic applications. However, you should verify your applications don't depend on it before deploying this mitigation.

Long-Term Fix

• Patch immediately: Update to kernel versions 6.19.13+ or your distribution's fixed kernel
• Audit access: Review who has local shell access to production systems
• Reduce blast radius: Implement least-privilege access so fewer accounts can reach vulnerable hosts
• Monitor for exploitation: Watch for unusual AF_ALG socket creation in audit logs

What This Means for Access Management

CopyFail is a stark reminder that local access is root access when kernel vulnerabilities exist. The vulnerability's 9-year existence proves that relying on kernel security alone is insufficient — you must control who gets local access in the first place.

This is exactly why modern access management principles matter:

• Just-in-Time access: Don't give standing SSH access to production servers. Grant time-limited sessions only when needed.
• Session recording: Every shell session should be recorded so exploitation attempts are visible.
• Least privilege: Reduce the number of humans with local access to production kernels.
• Identity-based access: Know exactly who accessed which server and when — not shared credentials that obscure attribution.

With a platform like OnePAM, you can ensure that even if a kernel LPE exists, the number of people who can exploit it is minimized, every access session is audited, and access expires automatically.

Timeline

Key Takeaways

CopyFail joins the lineage of Dirty Cow (2016) and Dirty Pipe (2022) as a reminder that Linux kernel privilege escalation vulnerabilities are not theoretical — they are practical, reliable, and dangerous. The best defense isn't just patching (though you must patch) — it's ensuring that fewer people have local access to your production infrastructure in the first place.