732 Bytes to Root: Copy Fail Turns the Kernel’s Crypto Subsystem Against Itself

The Deterministic Failure of Kernel Cryptography

CVE-2026-31431, known as Copy Fail, represents a significant departure from the typical, often unstable, landscape of local privilege escalation (LPE) exploits. Published on April 22, 2026, and subsequently added to the CISA Known Exploited Vulnerabilities catalog on May 1, 2026, this vulnerability targets the Linux kernel’s cryptographic subsystem. Specifically, it resides within the algif_aead module of the AF_ALG userspace crypto API.

The vulnerability is classified with a CVSS v3 score of 7.8 and a CVSS v4 score of 8.6. Most notably, it carries an EPSS score of 0.99907, indicating a near-certain probability of exploitation. This is not a theoretical research exercise; it is a reliable, deterministic tool for gaining a root shell from an unprivileged local user account.

Technical Mechanics of Copy Fail

The core of the issue is an incorrect resource transfer between spheres, specifically involving an in-place operation where source and destination buffers can overlap within the kernel’s cryptographic subsystem. This flaw allows for a controlled 4-byte write into the kernel page cache of any readable file. By targeting the in-memory representation of privileged binaries – such as /usr/bin/su – an attacker can achieve privilege escalation without ever modifying the actual file on the disk.