"An unprivileged local user can write four controlled bytes into the page cache of any readable file on a Linux system, and use that to gain root," Theori wrote in its public analysis of the flaw now tracked as CVE-2026-31431.
How Copy Fail (CVE-2026-31431) actually works
The vulnerability, dubbed Copy Fail, arises in the Linux kernel's authencesn cryptographic template and enables a local privilege escalation (LPE). According to Theori, exploiting the bug allows an unprivileged user to write four controlled bytes into the page cache for any readable file. Because the kernel reads the page cache when loading a binary, an attacker who can modify the cached copy can effectively alter the binary used for program execution without producing the file-system events that many defenses watch for — for example, inotify will not be triggered.
Theori's proof-of-concept is strikingly small: a 10-line, 732-byte Python script that can edit a setuid binary to gain root on "almost all Linux distributions released since 2017," the writeup states. The finders say Copy Fail resembles earlier LPEs such as Dirty Cow and Dirty Pipe but differs in that it reportedly does not require winning a race condition and is more broadly applicable.
Distribution responses: Debian, Ubuntu, SUSE, Red Hat and others
Major Linux distributions have begun shipping patches. The report specifically names Debian, Ubuntu, and SUSE as having issued fixes, and says overseers of other distributions have also released updates. Red Hat initially indicated it would defer the fix but later changed course and updated its guidance to align with other distributions and patch promptly.
The vulnerability carries a High severity rating: 7.8 out of 10. Because the bug is a local privilege escalation rather than a remote code execution, vendors and administrators are focusing on timely rollout of kernel updates to affected systems.
Why multi-tenant hosts, containers and CI runners are most exposed
Copy Fail is not remotely exploitable on its own, the writeup emphasizes, but it becomes materially dangerous when chained with other access vectors. Theori notes that a web RCE, a malicious continuous integration (CI) runner, or an SSH compromise could be combined with this LPE to achieve full system takeover. The issue is of "most immediate concern" to operators of multi-tenant Linux systems, shared-kernel containers, and CI runners that execute untrusted code.
Of particular note for cloud and container environments: the page cache is shared across the host, which Theori says creates a potential container escape primitive that could affect Kubernetes nodes. That shared-cache property is the mechanism that allows a local unauthenticated (but local) write into cached contents to influence execution of privileged binaries on the host.
Research, AI tools, and who found it
Theori credits researcher Taeyang Lee with identifying the vulnerability, assisted by the company's AI security scanning software, Xint Code. The report places the discovery in the broader context of a surge in bug reports driven in part by AI-powered flaw finders.
Trend Micro's Zero Day Initiative head of threat awareness, Dustin Childs, is quoted offering an explanation consistent with this trend: he expects the rise in submissions is due to security teams using AI to hunt bugs. The piece also notes that Microsoft recently reported its second largest number of patches ever, a statistic presented alongside the observation that AI-assisted tools have multiplied the number of bug reports in recent months. That increase has already prompted the Internet Bug Bounty (IBB) program to suspend awards while it decides how to manage a growing volume of submissions found by AI.
What this means for technologists, Kubernetes operators, and CI runners
- Technologists and security teams: prioritize applying kernel patches from Debian, Ubuntu, SUSE and other vendors, and verify the update guidance from Red Hat after its change in stance.
- Kubernetes operators and cloud platform engineers: pay attention to the shared page-cache detail — Theori flags that property as a potential container escape vector that could impact Kubernetes nodes; protecting hosts by promptly patching and limiting untrusted code execution on shared kernels is indicated by the report.
- CI and build infrastructure owners: treat untrusted runners and pipelines that execute community code as higher-risk until hosts are patched, since a malicious runner could chain an initial compromise with Copy Fail to escalate privileges on the host.
Severity, limits, and an ending observation
Rated 7.8 out of 10, Copy Fail is a high-severity local privilege escalation that pairs a small, practical exploit with a broadly applicable kernel artifact: the page cache. It is not itself a remote exploit, but the ease of the proof-of-concept and the shared-cache implications make it immediately consequential for shared environments. The precise operational impact will hinge on how quickly system operators install the available patches and how defenders adapt protections for multi-tenant and CI infrastructures when untrusted code runs on shared kernels.
