CVE 2026 31431: Linux Kernel "Copy Fail" High Severity Local Privilege Escalation

In late April 2026, security researchers disclosed a high-severity local privilege escalation vulnerability in the Linux kernel, codenamed “Copy Fail”, with the ID CVE-2026-31431. Working proof-of-concept code is public, and it reliably escalates a local unprivileged user to root. The vulnerability affects nearly all mainstream Linux distributions going back to 2017 and has been rated “Critical”.

Vulnerability Overview

The bug stems from a performance optimization defect introduced in 2017 in the kernel’s crypto subsystem (algif_aead module). A local unprivileged attacker can write controlled data to any readable file in the kernel page cache (for example, /usr/bin/su) by combining an AF_ALG socket with the splice() system call.

The public proof-of-concept script is only about 700 bytes and can complete the local privilege escalation in seconds. Worse still, the vulnerability can lead to a container escape, allowing an attacker inside a container to take full control of the host.

Scope

• Introduced: 2017
• Affected: nearly all mainstream Linux distributions since 2017
• Exploit complexity: low (public PoC available)
• Severity: critical
• Prerequisite: local code execution (any unprivileged account)

Impact on Shudou users

• The Shudou platform’s core services run on Debian 12, which is in scope for this vulnerability.
• Shudou hosts do not ship with Docker installed or enabled by default, so the “container escape to take over the host” attack path does not apply.

Recommended Action

Keep your Shudou host connected to the network for 48 hours. The host’s kernel update service will automatically fetch the fixed version and apply it — no manual action needed.

To verify proactively, run uname -r from the Shudou app or an SSH terminal. If the version string includes the post-fix commit, the vulnerability has been patched.

If you run into any issues during the update, feel free to post on the Shudou forum.