A vulnerability in the Linux kernel’s cryptographic interface can allow an unprivileged local attacker to gain root access on an affected system, Ubuntu and Red Hat security advisories state. Known as Copy Fail and tracked as CVE-2026-31431, the flaw requires local code execution; it does not provide remote access by itself.
Theori publicly disclosed technical details and a proof-of-concept exploit on April 29, 2026. Its disclosure timeline dates the upstream correction to April 1. The company traces the exploitable behavior to an in-place cryptographic processing optimization introduced in 2017.
Theori says the discovery began with researcher Taeyang Lee’s investigation into interactions between the Linux cryptographic subsystem and page-cache-backed data. Lee used the company’s Xint Code system to extend that research across the subsystem.
How the reported exploit works
Theori describes a logic flaw involving the authencesn cryptographic template and the algif_aead interface. Its technical account explains how the AF_ALG cryptographic interface and splice() system call can expose cached file data to an operation that writes four attacker-controlled bytes into that memory.
The page cache holds file contents in memory for reuse. Theori says the vulnerable path places references to those cached pages in a writable destination, allowing an unprivileged process to alter the cached contents of a file it can read.
The company’s proof of concept targets /usr/bin/su, a setuid-root executable. Theori says modifying its cached contents allows the altered program to produce a root shell when executed, while leaving the file’s on-disk contents unchanged.
Theori reports successful tests of the same 732-byte Python script on Ubuntu, Amazon Linux, Red Hat Enterprise Linux and SUSE. It describes the exploit as requiring neither a race condition nor distribution-specific offsets, and claims it works on essentially all Linux distributions shipped since 2017. That broader scope is the company’s claim, extending beyond the four distributions it says it directly tested.
Ubuntu’s security team also identifies possible container escape as an impact. Containers share the host kernel, making the flaw relevant to container platforms as well as shared servers and build systems. Exploitation still depends on access to the affected cryptographic functionality; a container foothold alone does not establish that every configuration can be compromised.
Theori says the corrupted cache pages are not marked for writeback, so the stored file remains unchanged. Under that account, checks confined to the unchanged on-disk bytes would miss the cached modification. This does not establish that exploitation would evade all runtime monitoring or file-integrity tools.
Upstream correction and mitigation limits
Upstream commit a664bf3d603d largely reverts the in-place optimization in algif_aead while retaining the copying of associated data. Ubuntu’s vulnerability record identifies that commit as the fix. Theori explains that separating the source and destination prevents cached file pages from being included in the writable destination.
Theori also recommends disabling algif_aead as a temporary mitigation. That approach depends on kernel configuration: blocking or unloading a loadable module does not disable functionality compiled directly into the kernel. The existence of the upstream correction does not establish which distribution-specific kernel packages contained it at the time of publication.
