Linux "Copy Fail" Vulnerability: Check If You're Affected and Fix It

On 29 April 2026, security researchers publicly disclosed a serious flaw in the Linux kernel that has quietly existed for nearly nine years. Tracked as CVE-2026-31431 and nicknamed "Copy Fail", this local privilege escalation vulnerability carries a CVSS score of 7.8, placing it firmly in high-severity territory. If an attacker gains even limited access to an affected system, they can escalate to full root control.

This is not a theoretical risk. A public proof-of-concept exploit already exists, and every mainstream Linux distribution that shipped kernels built since 2017 is potentially exposed. Vendor patches remain forthcoming as of this writing, which means you need to know whether your systems are affected and what interim measures actually work.

What Exactly Happened With the Copy Fail Vulnerability?

The vulnerability lives in the Linux kernel's AF_ALG interface, which provides applications direct access to cryptographic algorithms in the kernel. In 2017, developers introduced an in-place optimisation (commit 72548b093ee3) that was intended to improve performance by avoiding memory copies during certain cryptographic operations.

That optimisation contained a critical flaw. It allowed a local user to trigger a controlled 4-byte write to arbitrary page-cache-backed memory locations. By carefully crafting a sequence of system calls, an attacker could overwrite sensitive memory regions, including those belonging to setuid binaries. The result: local privilege escalation from a standard user account to full root access.

The core issue is not that Linux kernel security failed in 2026. The failure originated in an optimisation decision made nine years earlier, one that seemed reasonable at the time but created a pathway to privilege escalation that attackers have now fully characterised.

The fix itself is straightforward in principle. The mainline kernel received a correction on 1 April 2026 (commit a664bf3d603d) that reverts the problematic 2017 optimisation. The challenge is that this correction must propagate through every distribution's kernel packaging process, tested, and pushed to production systems. That pipeline takes time, and the exploit is already public.

Are You Affected? Distribution Status Breakdown

The short answer is: if you run any mainstream Linux distribution with a kernel built since 2017, you are likely affected. The nuance lies in whether your distribution has pushed a patched kernel to your systems yet.

Distribution	Affected Versions	Patch Status	Notes
Ubuntu	24.04 LTS, 22.04 LTS, 20.04 LTS	Patches pending	Only Ubuntu 26.04 (Resolute) and later are unaffected
Red Hat Enterprise Linux	RHEL 10.1, RHEL 9.x	Patches pending	Check Red Hat Security Advisory RHSB-2026-02 for updates
Amazon Linux	Amazon Linux 2023	Patches pending	Critical for AWS workloads
SUSE Linux Enterprise	SUSE 16 and earlier	Patches pending	SLES 15 SP5+ also affected
Debian	Kernels built since 2017	Patches pending	Check security.debian.org for announcements
Fedora	Current stable releases	Patches pending	Rolling release means quick propagation once available

Note that "patches pending" means no vendor-signed kernel packages are available as of 30 April 2026. This does not mean you are helpless. Interim mitigations exist and are actively recommended by CERT-EU.

How to Check If Your Systems Are Vulnerable

Before applying any fix, confirm your exposure. Run the following commands on each Linux system you manage.

Step 1: Identify Your Kernel Version

uname -r

This command outputs your running kernel version. All kernels built since 2017 with the problematic AF_ALG optimisation are potentially vulnerable. The presence of the vulnerability is not version-gated, which means even newer-looking kernels may contain the flaw.

Step 2: Check if AF_ALG is Enabled

The vulnerability requires the AF_ALG kernel module to be loaded or built into your kernel:

# Check if the module is currently loaded
lsmod | grep algifalgia

# If nothing returns, AF_ALG may not be loaded but could still be built-in
# Check kernel config for built-in support
grep -i "CONFIG_CRYPTO_USER_API_HASH\\|CONFIG_CRYPTO_USER_API_AEAD" /boot/config-$(uname -r)

If either of these checks returns results, your kernel has AF_ALG support and is potentially exploitable.

Step 3: Audit for Untrusted Workloads

Critically, assess who has local access to your systems. The vulnerability requires local access, so systems accessible only via SSH with key-based authentication and no local users are at lower risk than multi-user systems or those running container workloads.

Ask yourself these questions:

• Do untrusted users have shell accounts on this system?
• Does this system run containers or CI/CD pipelines that execute code from external sources?
• Is this a Kubernetes node where pod workloads might be considered untrusted?
• Does the system run any software that accepts and executes user-provided code or scripts?

If you answered yes to any of these, prioritise applying interim mitigations immediately.

How to Protect Your Systems Right Now

Since vendor patches remain unavailable, the following interim measures significantly reduce your exposure. Apply these in order of priority based on your risk assessment.

Priority 1: Disable the AF_ALG Interface

The most effective interim measure is to disable AF_ALG entirely. This prevents exploitation of the vulnerability:

# Block the kernel module from loading
echo "install algifalgia /bin/true" >> /etc/modprobe.d/blacklist.conf

# If already loaded, unload it immediately
rmmod algifalgia

# Verify it is no longer available
lsmod | grep algifalgia

Note that this approach may break applications that rely on AF_ALG for cryptographic operations. Common affected software includes certain TLS libraries, some cryptographic tools, and certain container runtimes. Test this change in a non-production environment first.

Priority 2: Restrict Local Access

Since this is a local privilege escalation, reducing who can access your systems locally or via limited shells is highly effective:

• Audit /etc/passwd for unnecessary local accounts and remove them
• Ensure SSH root login is disabled and key-based authentication is enforced
• Implement pam_access.so or fail2ban to limit login attempts
• Review sudo access and remove any users who do not strictly require it

Priority 3: Secure Kubernetes Nodes

CERT-EU specifically flagged Kubernetes nodes as high priority. Containers running with elevated privileges or host access are particularly exposed. Take these steps on every Kubernetes node:

1. Audit all pods for privileged: true or hostNetwork: true settings
2. Remove any pod security contexts that grant more access than necessary
3. Apply PodSecurityPolicies or Pod Security Standards to prevent privileged workloads
4. Ensure node内核版本 is tracked and update plans exist for when patches arrive

Priority 4: Secure CI/CD Runners

CI/CD runners frequently execute untrusted code from pull requests and external contributors. Treat these as high-risk systems:

• Use container isolation for all runner workloads
• Configure runners to run untrusted code in ephemeral, isolated environments
• Avoid caching or sharing volumes between jobs that might preserve exploit state
• Rotate runner credentials immediately if compromise is suspected

What Happens When Patches Arrive?

Once your distribution releases a patched kernel, apply it immediately. Kernel updates typically require a system reboot to take effect, so plan this during a maintenance window. Before rebooting:

• Test the new kernel in a staging environment
• Ensure your backup and recovery procedures are documented and tested
• Notify relevant stakeholders of the planned downtime
• Monitor system logs during and after reboot for any anomalies

After patching, you can verify the correction by checking that AF_ALG functionality remains intact while the specific vulnerability is addressed. Your distribution's security advisory will provide specific version numbers to target.

CERT-EU's recommendation to prioritise Kubernetes nodes and CI/CD runners reflects the reality of modern infrastructure: these systems run untrusted code regularly and represent the most likely attack vector for exploiting a local privilege escalation. Treat them accordingly.

Understanding the Real-World Risk

Local privilege escalation vulnerabilities often receive less attention than remote code execution flaws, but this perspective is dangerously outdated in 2026. Consider how modern infrastructure actually works:

Kubernetes pods, CI/CD pipelines, and shared hosting environments routinely execute code from multiple sources with varying levels of trust. A single compromised container or a malicious pull request can provide the local access needed to exploit CVE-2026-31431. From there, root access enables complete system compromise, data exfiltration, cryptocurrency mining, or using the system as a pivot point for lateral movement.

The existence of a public proof-of-concept exploit means that attackers do not need to develop their own tooling. They can adapt existing techniques and target your infrastructure today. The window between public disclosure and patch availability is precisely when attackers are most active.

Longer-Term Considerations

Beyond immediate mitigation, this vulnerability raises broader questions about kernel security practices. The nine-year dormancy period of this flaw demonstrates that even well-audited codebases can contain subtle exploitable patterns. Consider these longer-term strategies:

Strategy	Description	Effort Level
Automated kernel patching	Use tools like kexec or live patching where available to reduce reboot friction	Medium
Kernel hardening	Enable SMEP, SMAP, and other CPU-level protections to reduce exploit reliability	Low
Zero-trust local access	Treat local users and containers as untrusted regardless of apparent permissions	Medium
Vulnerability monitoring	Subscribe to CERT-EU, distribution security lists, and CVE feeds for faster response	Low

If your team has the appetite for a deeper look at vulnerability management in practice, our guide on checking for and fixing the Axios supply chain attack follows a similar structured approach to security remediation that transfers well to kernel-level issues.

Similarly, the React vulnerability from earlier in 2026 demonstrates that even mature, widely-used projects face serious security incidents that require rapid response and systematic mitigation.

Key Takeaways

• CVE-2026-31431 affects every mainstream Linux distribution with kernels built since 2017
• No vendor patches are available yet, but interim mitigations are effective
• Disable AF_ALG if your workloads allow it, or restrict local access aggressively
• Prioritise Kubernetes nodes and CI/CD runners where untrusted code executes
• Monitor your distribution's security channels for patch availability
• Plan for kernel updates and reboots once patches arrive

The Copy Fail vulnerability is serious but manageable with the right response. The window between disclosure and patches is the period of highest risk. Take action now, apply the mitigations that fit your environment, and stay alert for patch announcements from your distribution.