Linux Kernel Local Privilege Escalation – "Copy Fail" (CVE-2026-31431)

Scope: Linux Kernel (All Major Distributions – Kernels Built Since 2017)

Severity: High

A logic flaw dubbed "Copy Fail" in the Linux kernel's algif_aead cryptographic module allows any unprivileged local user to gain root access via a deterministic, race-condition-free exploit — a single 732-byte Python script that works unmodified across Ubuntu, Red Hat, Amazon Linux, SUSE, Debian, and other major distributions. Unlike previous kernel privilege escalation bugs, this requires no timing windows or per-distribution offsets, making it trivially portable and reliable, and particularly dangerous in multi-tenant, CI/CD, and Kubernetes environments where container escape is a secondary risk. Organizations should apply vendor-issued kernel patches immediately; where patching is not immediately possible, disabling the algif_aead kernel module serves as an interim mitigation — though RHEL-family distributions should note that the modprobe blacklist workaround is ineffective on kernels with the module compiled in.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.