security
Apr 30, 2026
By Teun
Linux Copy Fail flaw gives attackers root on every major distro since 2017
CVE-2026-31431, dubbed Copy Fail, is a nine-year-old privilege escalation flaw in the Linux kernel's cryptographic subsystem. A 732-byte Python script gives any local user root access on nearly all distros. CISA has added it to the KEV catalog.
A newly disclosed Linux kernel flaw, tracked as CVE-2026-31431 and nicknamed Copy Fail, can give a local attacker full root access on most major distributions with a short Python exploit. According to The Register, the bug has existed since 2017, which means many systems have been exposed for years before the issue was publicly identified and added to the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities, or KEV, catalog.
Copy Fail sits in the Linux kernel’s cryptographic subsystem, the part of the operating system that handles encryption and related security functions. The problem is not a flashy remote worm or a web app bug, but a privilege escalation flaw, meaning an attacker who already has some level of access on the machine can turn that access into full administrative control.
⚡ New to this?
This is a Linux kernel bug, which means the problem is in the core of the operating system itself, not in one app. A kernel is the part of the OS that controls hardware and security boundaries, so a flaw there can let a normal user become root, the superuser account with full control.
CVE is the standard ID system for publicly tracked security bugs, and KEV is CISA’s list of vulnerabilities that are already being abused. Non-experts should care because Linux runs a lot of servers, cloud systems, and security tools, so a kernel bug with a simple exploit can affect a lot of infrastructure at once.
🦞 OpenClaw angle
If you run Linux servers or VMs, check your kernel version and patch immediately. The exploit leaves no forensic trace on disk. Mitigate by disabling the algif_aead kernel module until your distro ships a patched kernel.
That matters because Linux is the base layer for a huge amount of modern infrastructure, from cloud servers and virtual machines to embedded devices and developer workstations. When a kernel bug affects the core of the OS, it can cut across many different products at once, which is why a flaw in a single subsystem can end up being a problem for nearly every mainstream distro.
The reported exploit is unusually small. The Register said a 732-byte Python script is enough to trigger the issue and obtain root on systems that are still vulnerable. Root is the Unix and Linux term for the highest-privileged account on the machine, the one that can read, modify, or delete almost anything.
The name “Copy Fail” refers to the way the flaw appears to break down in the kernel’s handling of data copied during cryptographic operations. Kernel bugs like this are especially serious because they run in the same trusted part of the system that protects everything else. If an attacker can manipulate that code path, they may be able to escape normal permission boundaries.
CISA’s decision to add the bug to the KEV catalog raises the urgency for defenders. The KEV list is CISA’s public record of vulnerabilities that are known to be exploited in the wild, and federal agencies are expected to prioritize patching those issues quickly. For private organizations, the list is also a strong signal that a bug has moved from theoretical risk to active operational concern.
The age of the flaw is part of what makes it notable. A bug present since 2017 suggests that a large population of systems may have inherited it through normal kernel updates over multiple release cycles. Because Linux kernels are often packaged and patched by distributions rather than installed directly from upstream sources, the real-world exposure depends on which kernel builds shipped the vulnerable code and whether they have received fixes.
The Register’s reporting indicates the issue spans nearly all major distros, which is consistent with how kernel-level flaws tend to spread. When the vulnerability lives below the user-space tools that people interact with, the same root cause can affect many different environments without any visible sign at the application layer.
The other operational concern is that kernel exploits can be hard to reconstruct after the fact. Depending on how they are used, they may not leave obvious artifacts on disk, which makes host-based response and detection more difficult than for a normal malware infection. That leaves patching and kernel-level mitigation as the main lines of defense while vendors push fixes through their package channels.
