SUSE: New Linux 'Copy Fail' Vulnerability Enables Root Access on Major Distributions

Linux Kernel Flaw (CVE-2026-31431) Enables Local Privilege Escalation to Root

Cybersecurity researchers from Xint.io and Theori have disclosed a high-severity Linux local privilege escalation (LPE) vulnerability, tracked as CVE-2026-31431 (CVSS 7.8), which allows an unprivileged local user to gain root access. Dubbed "Copy Fail", the flaw stems from a logic error in the Linux kernel’s cryptographic subsystem, specifically within the algif_aead module, introduced in a 2017 code commit.

Exploitation requires only a 732-byte Python script, which manipulates the kernel’s page cache to modify a setuid binary (e.g., /usr/bin/su), enabling arbitrary code execution as root. The attack involves four key steps:

1. Opening an AF_ALG socket bound to authenc(hmac(sha256),cbc(aes)).
2. Crafting a shellcode payload.
3. Triggering a write operation to the kernel’s cached copy of a privileged binary.
4. Executing the binary to run the injected code with root privileges.

The vulnerability affects all major Linux distributions released since 2017, including Amazon Linux, RHEL, SUSE, and Ubuntu. While not remotely exploitable, it poses a significant risk in multi-user or containerized environments, as the page cache is shared system-wide, allowing cross-container impacts.

Security experts note that Copy Fail shares similarities with Dirty Pipe (CVE-2022-0847), another LPE flaw that enabled unauthorized writes to read-only files. However, Copy Fail is distinguished by its portability, small exploit size, stealth, and cross-container capabilities, making it particularly dangerous. Unlike many kernel exploits, it does not rely on race conditions or kernel offsets, ensuring reliable exploitation across distributions.

In response to the disclosure, affected Linux vendors have released security advisories to address the flaw. The vulnerability underscores the ongoing risks of kernel-level logic errors in widely deployed systems.

Source: https://thehackernews.com/2026/04/new-linux-copy-fail-vulnerability.html

SUSE cybersecurity rating report: https://www.rankiteo.com/company/suse

"id": "SUS1777552033",
"linkid": "suse",
"type": "Vulnerability",
"date": "8/2017",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'industry': 'Technology',
                        'name': 'Amazon Linux',
                        'type': 'Operating System'},
                       {'industry': 'Technology',
                        'name': 'RHEL',
                        'type': 'Operating System'},
                       {'industry': 'Technology',
                        'name': 'SUSE',
                        'type': 'Operating System'},
                       {'industry': 'Technology',
                        'name': 'Ubuntu',
                        'type': 'Operating System'}],
 'attack_vector': 'Local',
 'description': 'Cybersecurity researchers from Xint.io and Theori have '
                'disclosed a high-severity Linux local privilege escalation '
                '(LPE) vulnerability, tracked as CVE-2026-31431 (CVSS 7.8), '
                'which allows an unprivileged local user to gain root access. '
                "Dubbed 'Copy Fail', the flaw stems from a logic error in the "
                'Linux kernel’s cryptographic subsystem, specifically within '
                'the algif_aead module, introduced in a 2017 code commit. '
                'Exploitation requires only a 732-byte Python script, which '
                'manipulates the kernel’s page cache to modify a setuid binary '
                '(e.g., /usr/bin/su), enabling arbitrary code execution as '
                'root.',
 'impact': {'operational_impact': 'Arbitrary code execution as root, '
                                  'cross-container impacts',
            'systems_affected': 'All major Linux distributions released since '
                                '2017'},
 'lessons_learned': 'The vulnerability underscores the ongoing risks of '
                    'kernel-level logic errors in widely deployed systems.',
 'post_incident_analysis': {'corrective_actions': 'Security patches and '
                                                  'advisories released by '
                                                  'affected Linux vendors.',
                            'root_causes': 'Logic error in the Linux kernel’s '
                                           'cryptographic subsystem '
                                           '(algif_aead module), introduced in '
                                           'a 2017 code commit.'},
 'recommendations': 'Apply security patches released by Linux vendors to '
                    'mitigate the flaw.',
 'references': [{'source': 'Xint.io and Theori'}],
 'response': {'remediation_measures': 'Security advisories and patches '
                                      'released by affected Linux vendors'},
 'title': 'Linux Kernel Flaw (CVE-2026-31431) Enables Local Privilege '
          'Escalation to Root',
 'type': 'Local Privilege Escalation (LPE)',
 'vulnerability_exploited': 'CVE-2026-31431'}