Linux ‘Copy Fail’ Roots Every System Since 2017—Exploit Code Public
Copy Fail gives root access on every Linux distro since 2017. Exploit code is public—patches rolling out but adoption slow. The flaw sat undetected for nine years.
- Copy Fail gives unprivileged users root access on every Linux distro since 2017.
- Exploit code is already public—patches are rolling out but adoption is slow.
- The flaw sat undetected for nine years until AI scanning found it.
A critical zero-day vulnerability in the Linux kernel is giving attackers root access on virtually every major distribution shipped since 2017. The flaw, dubbed Copy Fail (CVE-2026-31431), allows any unprivileged local user to write four controlled bytes into the page cache of any readable file and use that to gain system-wide privileges.
The vulnerability stems from a logic error in the Linux kernel’s authencesn cryptographic template. It affects Debian, Ubuntu, Red Hat Enterprise Linux, Fedora, Arch Linux, and virtually every other distribution released in the past nine years. Exploit code was publicly released Wednesday evening by researchers from security firm Theori.
“The CopyFail vulnerability is significant because it is easy to exploit and affects most, if not all, Linux systems currently in production,” said Wolfgang Ullrich, a security researcher at Qualys. “The good news is, it’s not remotely exploitable.”
Why Copy Fail Has Defenders Scrambling
The vulnerability is particularly dangerous because it requires only local access—no special privileges or configuration changes needed. An attacker who gains even limited access to a system through another vulnerability or a compromised account can immediately escalate to root. This makes it especially concerning for shared hosting environments, cloud instances, and any system where multiple users have shell access.
Arch Linux and RedHat Fedora have already released patches, but other distributions are still working on fixes. The exploit uses a Python script to trigger the vulnerability, making it accessible even to attackers with limited technical expertise. Security researchers are urging administrators to apply patches as soon as they become available and to monitor for suspicious activity on Linux systems.
The flaw was discovered using AI-assisted code scanning, highlighting how machine learning tools are finding vulnerabilities that human reviewers have missed for nearly a decade. Theori researchers found the bug five weeks before public disclosure, giving some vendors time to prepare patches—but not all distributions were ready when exploit code dropped.
Developers of major Linux distributions have begun shipping patches to address the vulnerability, reported The Register. The newly disclosed LPE comes from a vulnerability in the Linux kernel’s cryptographic template.
Cybersecurity researchers have disclosed details of the Linux local privilege escalation flaw that could allow an unprivileged local user to obtain root, noted The Hacker News.
Some distributions have already released patches or mitigations for the exploit, including Arch Linux and RedHat Fedora, reported The Verge.
The vulnerability is tracked as CVE-2026-31431.
