Linux Kernel Vulnerability CVE-2026-31431 (CopyFail) Enables Local Privilege Escalation Across Distributions

Sat, 02 May 2026 11:42:00 +0200

A newly disclosed vulnerability in the Linux kernel, dubbed CopyFail and tracked as CVE-2026-31431, allows unprivileged users to escalate their privileges to root on affected systems. Researchers from security firm Theori publicly released working exploit code on May 1, 2026, after privately reporting the issue to the kernel team. The flaw is a logic error in the kernel's crypto API related to the AEAD template processing for IPsec extended sequence numbers. Instead of properly copying data, it uses the caller's buffer as a scratch pad and writes beyond the intended region. Because it exploits a deterministic logic flaw rather than a race condition or memory corruption, a single Python script works reliably across multiple distributions including Ubuntu 22.04, Amazon Linux 2023, SUSE 15.6, and Debian 12 without modification. The vulnerability has been patched in recent kernel versions such as 6.12.85, 6.6.137, and others, but many Linux distributions had not yet incorporated the fixes