CVE-2026-31431, dubbed Copy Fail, is a critical local privilege escalation vulnerability in the Linux kernel affecting distributions released since 2017. By abusing the AF_ALG socket interface and the authencesn cryptographic template, an attacker can perform a controlled write into the in-memory page cache of setuid binaries, gaining root access without altering on-disk files.
CVE-2026-31431
6 posts
Copy Fail Flaw: 5 YARA Rules for Detection How Dirty Frag rose from the Copy Fail exploit CVE-2026-31431, also known as Dirty Frag or Copy Fail, is a Linux kernel local privilege escalation vulnerability that allows attackers to write to read-only memory regions via page-cache abuse. Active exploitation was observed prior to the public embargo break, with threat actors deploying ELF binaries, Python scripts, and malicious PyPI packages to achieve root access, notably including adoption by the Multiverze trojan family.
Copy Fail and DirtyFrag: Linux Page Cache Bugs in the Wild Copy Fail and DirtyFrag are critical Linux kernel privilege escalation vulnerabilities that exploit page cache corruption via legitimate kernel interfaces like AF_ALG and splice(). These flaws allow local attackers to corrupt the in-memory view of setuid binaries or critical files like /etc/passwd to gain root access. Copy Fail has been exploited in the wild, prompting CISA to add it to the Known Exploited Vulnerabilities catalog.
Proof-of-concept exploit available for Linux 'Copy Fail' vulnerability (CVE-2026-31431) CVE-2026-31431, dubbed 'Copy Fail', is a high-severity (CVSS 7.8) local privilege escalation vulnerability in the Linux kernel affecting distributions released since 2017. A reliable public PoC is available, allowing unprivileged local users to achieve root access by corrupting the kernel's in-memory page cache of privileged binaries. Immediate patching is recommended, particularly for multi-tenant and containerized environments.
CISA Adds One Known Exploited Vulnerability to Catalog CISA has added CVE-2026-31431, an 'Incorrect Resource Transfer Between Spheres' vulnerability affecting the Linux Kernel, to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. Organizations are strongly urged to prioritize the timely remediation of this vulnerability to reduce their exposure to cyberattacks.
Security Advisory 2026-005 CVE-2026-31431, dubbed 'Copy Fail', is a CVSS 7.8 local privilege escalation vulnerability in the Linux kernel's algifaead module affecting kernels built since 2017. By chaining an AFALG socket operation with splice(), an unprivileged local user can overwrite page-cache-backed pages, such as setuid binaries, to obtain root privileges. With a public PoC available and vendor patches pending, immediate mitigation via module disabling or seccomp filtering is critical.
