Research · CVE-2026-31431
CopyFail
A logic flaw in the Linux kernel's cryptographic subsystem lets an unprivileged local user write four controlled bytes into the page cache of any readable file on the system. That is enough to alter the behaviour of a privileged binary such as su, in memory and without touching the file on disk. It escapes containers, because they share the page cache with the host. I studied it over a long weekend, reproduced it on Debian 13, Ubuntu 24.04, Kali and Docker, and wrote variants in several languages. One of them, in C, compiles with gcc and runs on any distribution with no dependencies.
ActiveCRustLinuxDocker★ 7last change: May 2026
7.8CVSS · CISA KEV catalogue
Vulnerability disclosed and fixed by the vendor. The mechanism of the flaw is described; there is no proof of concept, reproducible steps or lab material. The official advisory links to the version that fixes it.