{"id":237333,"date":"2026-04-30T05:24:00","date_gmt":"2026-04-30T09:24:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/04\/30\/new-linux-copy-fail-vulnerability-enables-root-access-on-major-distributions\/"},"modified":"2026-04-30T05:50:10","modified_gmt":"2026-04-30T09:50:10","slug":"new-linux-copy-fail-vulnerability-enables-root-access-on-major-distributions","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/04\/30\/new-linux-copy-fail-vulnerability-enables-root-access-on-major-distributions\/","title":{"rendered":"New Linux &#8216;Copy Fail&#8217; Vulnerability Enables Root Access on Major Distributions"},"content":{"rendered":"<p><a href=\"https:\/\/thehackernews.com\/2026\/04\/new-linux-copy-fail-vulnerability.html\">New Linux &#8216;Copy Fail&#8217; Vulnerability Enables Root Access on Major Distributions<\/a><\/p>\n<p><a href=\"https:\/\/thehackernews.com\/2026\/04\/new-linux-copy-fail-vulnerability.html\">https:\/\/thehackernews.com\/2026\/04\/new-linux-copy-fail-vulnerability.html<\/a><\/p>\n<p>Publish Date: <a href=\"publish_date]\">2026-04-30 05:24:00<\/a><\/p>\n<p>Source Domain: <a href=\"thehackernews.com\">thehackernews.com<\/a><\/p>\n<p><span class=\"p-author\">\ue804<span class=\"author\">Ravie Lakshmanan<\/span>\ue802<span class=\"author\">Apr 30, 2026<\/span><\/span><span class=\"p-tags\">Linux \/ Vulnerability<\/span><\/p>\n<p>Cybersecurity researchers have disclosed details of a Linux local privilege escalation (LPE) flaw that could allow an unprivileged local user to obtain root.<\/p>\n<p>The high-severity vulnerability tracked as <strong>CVE-2026-31431<\/strong> (CVSS score: 7.8) has been codenamed <strong>Copy Fail<\/strong> by Xint.io and Theori.<\/p>\n<p>&#8220;An unprivileged local user can write four controlled bytes into the page cache of any readable file on a Linux system, and use that to gain root,&#8221; the vulnerability research team at Xint.io and Theori said.<\/p>\n<p>At its core, the vulnerability stems from a logic flaw in the Linux kernel&#8217;s cryptographic subsystem, specifically within the algif_aead module. The issue was introduced in a source code commit made in August 2017.<\/p>\n<p>Successful exploitation of the shortcoming could allow a simple 732-byte Python script to edit a setuid binary and obtain root on essentially all Linux distributions shipped since 2017, including Amazon Linux, RHEL, SUSE, and Ubuntu. The Python exploit involves four steps &#8211;<\/p>\n<ul>\n<li>Open an AF_ALG socket and bind to authencesn(hmac(sha256),cbc(aes))<\/li>\n<li>Construct the shellcode payload<\/li>\n<li>Trigger the write operation to the kernel&#8217;s cached copy of &#8220;\/usr\/bin\/su&#8221;<\/li>\n<li>Call execve(&#8220;\/usr\/bin\/su&#8221;) to load the injected shellcode and run it as root<\/li>\n<\/ul>\n<p>While the vulnerability is not remotely exploitable in isolation, a local unprivileged user can get root simply by corrupting the page cache of a setuid binary. The same primitive also has cross-container impacts as the page cache is shared across all processes on a system.<\/p>\n<p><img decoding=\"async\" alt=\"\" border=\"0\" data-original-height=\"975\" data-original-width=\"1362\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiruJOnU3GSCs2LM43I7P3LvgVHs02zecnSwv249yJAVngDdbaqjejSLjF0upGIBJMZ-Nsm1dwsxn4_HeF92V1MW8gTkRmp4UYp6BbMaxo893xMpnr0FEIUuFgd1zX_VI1skQcq_sOEpyC5vRYluPAqRvUsVrJaB5qx5iTn3yAbikkNURqpP8jxpGh3vrL7\/s1600\/linux-fail.jpg\"\/><\/p>\n<p>In response to the disclosure, Linux distributions have released their own advisories &#8211;<\/p>\n<p>Copy Fail has its echoes in Dirty Pipe (CVE-2022-0847), another Linux kernel LPE vulnerability that could permit unprivileged users to splice data into the page cache of read-only files and ultimately overwrite sensitive files on the system to achieve code execution.<\/p>\n<p>&#8220;Copy Fail is the same class of primitive, in a different&#8230;<\/p>\n<p><a href=\"https:\/\/thehackernews.com\/2026\/04\/new-linux-copy-fail-vulnerability.html\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>New Linux &#8216;Copy Fail&#8217; Vulnerability Enables Root Access on Major Distributions https:\/\/thehackernews.com\/2026\/04\/new-linux-copy-fail-vulnerability.html Publish Date: 2026-04-30&#8230;<\/p>\n","protected":false},"author":1,"featured_media":237334,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhYpnBkrLNj-dAKcwAbvRIvfXg8YDXoO3yfrl3vvXBOBwo2zga2asWZ0at4FLcLbiqQ1N7BsYA2szKbuqeVLBkrD80tMqYguBbqvrhEude6Fe9ayQpNs-meP8h4-f6ReWVeIU0zYp31XU7K-Kgxm5OKdI77HPQWgTx41al_WH3gYkMjEoROl6zvXF8HPRf5\/s1600\/root.jpg","fifu_image_alt":"","footnotes":""},"categories":[48],"tags":[90,31,89,71,79,27],"class_list":["post-237333","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-linux","tag-cve","tag-exploit","tag-flaw","tag-linux","tag-ubuntu","tag-vulnerability"],"_links":{"self":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/237333"}],"collection":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=237333"}],"version-history":[{"count":1,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/237333\/revisions"}],"predecessor-version":[{"id":237335,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/237333\/revisions\/237335"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/237334"}],"wp:attachment":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=237333"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=237333"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=237333"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}