New Linux 'Copy Fail' Vulnerability Enables Root Access on Major Distributions

Source: The Hacker News

Overview

Cybersecurity researchers have disclosed a Linux local privilege escalation (LPE) flaw that could allow an unprivileged local user to obtain root privileges.

Vulnerability Details

• CVE: CVE‑2026‑31431
• CVSS Score: 7.8 (high severity)
• Codename: “Copy Fail” (named by Xint.io and Theori)

Exploitation Mechanics

An unprivileged local user can write four controlled bytes into the page cache of any readable file on a Linux system, enabling escalation to root.

Impact

The vulnerability affects major Linux distributions that use the affected kernel components, potentially allowing attackers with local access to gain full system control.

Mitigation

• Apply the security patches released by your distribution as soon as they become available.
• Until patches are applied, limit local user access to untrusted parties and monitor for suspicious activity involving file cache manipulation.

References

• CVE‑2026‑31431 entry (link to official CVE database)
• Security advisory from Xint.io
• Security advisory from Theori