Research
CopyFail
A logic flaw in the Linux kernel's cryptographic subsystem lets an unprivileged local user write four controlled bytes into the page cache of any readable file on the system. That is enough to alter the behaviour of a privileged binary such as su, in memory and without touching the file on disk. It escapes containers, because they share the page cache with the host. I studied it over a long weekend, reproduced it on Debian 13, Ubuntu 24.04, Kali and Docker, and wrote variants in several languages, including one in C that compiles with gcc and runs on any distribution with no dependencies.
7 starsRustlast change: May 2026
This analysis covers a vulnerability already disclosed and fixed by its vendor, and it describes the mechanism of the flaw without handing over anything executable. There is no proof of concept, no reproducible steps and no lab material. If you run an affected system, the link to the official advisory leads to the version that fixes it.