New Linux ‘Copy Fail’ flaw gives hackers root on major distros

Copy Fail (CVE-2026-31431) is a logic bug in the Linux kernel's cryptographic template that allows an authenticated user to perform a 4-byte write into the page cache of any readable file on the system. The vulnerability combines the AF_ALG socket-based interface with the splice() system call to make controlled writes to the page cache instead of normal buffer. If these 4 bytes hit a setuid-root binary, they can alter its behavior when executed, giving the attacker root privileges. The flaw was introduced in 2017 when Linux kernel team added an 'in-place' optimization to the crypto path, reusing the same buffer rather than keeping input and output separate.