‘Trivial’ exploit can give attackers root access to Linux kernel

CSOs must ensure their Linux-based systems block unauthorized privilege escalation until distros release patches to plug a serious kernel vulnerability affecting all Linux distributions shipped since 2017. Until fixes are available for what’s been dubbed the Copy Fail logic bug ( CVE-2026-31431 ), which lets users easily obtain root access, there isn’t much CSOs can do, says Johannes Ullrich , dean of research at the SANS Institute, as long as they have monitoring for privilege escalation already in place. With root access, a threat actor can do anything to a system, from data theft to data erasure. “The CopyFail vulnerability is significant because it is easy to exploit and affects most, if not all, Linux systems currently in production,” Ullrich said in an email. “On the other hand,” he noted, “privilege escalation vulnerabilities are somewhat common, and an attacker must first be able to execute code on the system to exploit them. Common configuration weaknesses can also open the door to privilege escalation.” Still, this vulnerability should be addressed, but does not require specific prioritization. “As soon as patches are released, they should be applied,” he said. “A reboot may be necessary to fully protect affected systems after the patch is applied.” As of midday Thursday, only Arch Linux had released a patch, he said. But he believes other distributions will likely release one in the next few days. “Until then,” he added, “there is an option to add a specific kernel parameter, but applying it requires a reboot and is not feasible in a large environment, at least not before a patch is released.” Kernel logic bug The vulnerability was discovered by researchers at South Korea-based Theori, in part with the help of its AI vulnerability scanner. It was reported to the Linux kernel security team on March 23. On April 1, patches were committed to the mainline kernel, with a CVE assigned on April 22. General public disclosure was made only this week when Theori published a blog on its work. Copy Fail is a logic bug in the Linux kernel’s authencesn cryptographic template. It lets an unprivileged local user trigger a deterministic, controlled 4-byte write into the page cache of any readable file on the system; Theori’s exploit is a single 732-byte Python script. The result: that unauthorized user obtains root access. The vulnerability also allows an escape from Kubernetes containers, Theori added, which it said it will explain in a future blog. CSOs, Linux admins, and others can find more information about the issue at the Copy Fail website , which is maintained by the Theori researchers. Theori said the systems that should be patched first when fixes are released are multi-tenant Linux hosts; systems with Kubernetes containers; continuous integration runners and build farms including GitHub actions, GitLab runners or Jenkins agents; and cloud SaaS systems running user code, such as notebook hosts, agent sandboxes, serverless functions, or any tenant-supplied container or script. ‘Enormous’ number of affected distros The number of affected distributions is “enormous,” said Kellman Meghu , CTO of Canadian incident response firm DeepCove Security, “and the speed [at which] this hit was not nearly long enough to get the kernel patched, tested and distributed to every distro” after discovery of the flaw last month. “There is not much of anything you can do but start your inventory of risky systems and watch for each distro update,” he said. “Apply kernel patches immediately (if possible) and try to isolate or monitor any shared Linux systems until patched. Ask all your vendors and third party supply chains for their plans and risk assessments to ensure you are careful interacting with other systems that could be at risk.” For Debian, Ubuntu, and other Debian-based systems, the exploitable code is in a separate kernel module that could be disabled via kernel commands, Meghu added. However, many other distros compile it into the kernel and may not be as easily changed. This is unique to each distro, he said, so having an inventory and a plan for each is vital to getting ahead of the vulnerability. [Related content: VoidLink malware targets Linux cloud servers ] Straight line logic flaw Copy Fail isn’t the first high-profile privilege escalation bug, Theori researchers noted. Dirty Cow (CVE-2016-5195) required winning a race condition in the VM subsystem’s copy-on-write path. It often needed multiple attempts to succeed, and sometimes crashed the system. Dirty Pipe (CVE-2022-0847) was version-specific and required precise pipe buffer manipulation. But Copy Fail is a straight-line logic flaw, the researchers said, which triggers without races, retries, or crash-prone timing windows. The exploit Theori created worked on Ubuntu, Amazon Linux, RHEL, and SUSE Linux. Shared systems under ‘extreme risk’ “The exploit is trivial,” said DeepCove Security’s Meghu. “The good news is, it’s not a remote code execution, which gives us breathing room to patch when fixes are available, but there needs to be priority placed on any shared systems, since any local user could easily escalate their privilege to root. Those systems are under extreme risk right now.” His biggest fear is that an exploit could become be part of a chain of attacks. Because the escalation of privilege part of it is trivial to accomplish, he said, “I am not at all thrilled about waiting for patches.” An exploit could hit all of an IT department’s Linux systems and containers, as well as the organization’s supply chain, and it will take a “significant amount of work” to patch and verify every system, he said, which means CSOs will need to have a good handle on their software inventory and dependencies. “I am also very worried about the endless amount of Linux-based hardware devices out there that probably don’t get patched often, if at all, and will be part of IoT or consumer systems for years to come,” Mehgu added. “If you are in the business of supporting Linux-based hardware devices, this is not going to be a good day for you.” “This [vulnerability] makes the living off the land attacks incredibly easy,” he concluded, “so watching your systems for unusual activity has never been more critical.”