New Linux ‘Copy Fail’ Vulnerability Enables Root Access on Major Distributions

Security researchers have disclosed a high-severity local privilege escalation vulnerability in Linux systems known as Copy Fail (CVE-2026-31431). The flaw allows unprivileged local users to write four controlled bytes into the page cache of any readable file, potentially granting root access on affected distributions.

What happened

Cybersecurity researchers from Xint.io and Theori revealed details of a significant Linux vulnerability termed Copy Fail. This local privilege escalation flaw enables an attacker with local access and no special privileges to manipulate the page cache of any readable file on the system by writing four controlled bytes. This capability can be leveraged to elevate privileges to root, compromising system integrity.

Why it matters

The vulnerability has a high severity rating with a CVSS score of 7.8, indicating a substantial risk to Linux system security. Since the exploit allows unprivileged users to gain root access, it could lead to complete system takeover, data breaches, or disruption in critical environments relying on Linux. Organizations utilizing affected Linux distributions must address this risk promptly to prevent potential exploitation.

What security teams should do

Security teams are advised to monitor disclosures for available patches or mitigations addressing CVE-2026-31431. Reviewing local user permissions and access controls can help limit exposure. Until official fixes are applied, limiting untrusted local access and closely auditing systems for unusual activity related to page cache manipulation are prudent defensive measures.

Key technical details

The vulnerability exploits the ability of an unprivileged local user to write exactly four targeted bytes into the Linux page cache for any file that is readable by the user. This manipulation can corrupt critical system files or binaries in memory, facilitating a local privilege escalation to root. This flaw affects the page cache mechanism of the Linux kernel and leverages nuanced behavior in memory management.

Affected organizations/products

The Copy Fail vulnerability impacts multiple major Linux distributions due to the shared underlying kernel mechanism. Specific affected versions or distributions have not been detailed beyond the general Linux environment. No information yet about known exploitation in the wild has been provided.

Source attribution

https://thehackernews.com/2026/04/new-linux-copy-fail-vulnerability.html