Copy.fail / CVE-2026-31431: Linux kernel local privilege escalation vulnerability and help wanted

Patrick · April 30, 2026, 3:04pm

copy.fail documents CVE-2026-31431, a Linux kernel local privilege escalation vulnerability.

In plain language: code that is already running as a normal local user may be able to become root This is especially relevant for shared servers, container hosts, CI runners, build systems, and systems that run untrusted code.

What users should do

For most users, the main action is simple:

Update your system normally, install kernel security updates when available, and reboot into the updated kernel.

Temporary mitigations have been discussed, but they can have compatibility risks. Users who are unsure should prefer official distribution kernel updates over manual kernel feature changes. See the copy.fail / CVE-2026-31431 wiki page for current mitigation notes and references.

Relation to Kicksecure

This issue is unspecific to Kicksecure. Kicksecure inherits the issue because it is based on Debian.

The wiki page collects the current mitigation notes, Debian status notes, technical background, and links to upstream resources:

copy.fail security vulnerability (CVE-2026-31431)

Help wanted: reduce SUID attack surface

This vulnerability is also a reminder that local privilege escalation bugs remain a long-term Linux security problem.

Kicksecure already reduces the number of SUID binaries reachable by normal users through the SUID Disabler and Permission Hardener. However, the list is not zero yet. Some remaining SUID binaries cannot simply be disabled because that would break existing software.

Volunteer developers can help by working with upstream projects to replace SUID designs with safer alternatives, such as Linux capabilities or other privilege separation mechanisms.

Useful work includes:

identifying remaining SUID binaries that are still reachable by normal users
checking why each one still needs SUID
testing whether Linux capabilities are sufficient
proposing patches directly to upstream projects
documenting compatibility issues when SUID cannot yet be removed

This work is unspecific to Kicksecure. Improvements made upstream can benefit many Linux distributions.

If you do not work on this, it will probably not happen, and SUID will remain a security issue for many years.

Stay tuned

This blog post is a short announcement. The Kicksecure wiki page about copy.fail / CVE-2026-31431 is the primary source and will be kept more up to date. See: Wiki is the Primary Source of Information vs Forums.

Follow Kicksecure news here:

Patrick · May 1, 2026, 11:25am

Fixed in Debian trixie (security) APT repository.

FranklyFlawless · May 9, 2026, 1:04am

Two more related to Copy.fail:

github.com/V4bel/dirtyfrag

assets/write-up.md

07995be9d

<p align="center">
  <img src="tux.png" width="400" alt="tux">
</p>

# Intro

![demo](demo.gif)


For the exploit code and mitigation, [see here](../README.md).

Dirty Frag is a vulnerability (class) that achieves root privileges on most Linux distributions by chaining the xfrm-ESP Page-Cache Write vulnerability and the RxRPC Page-Cache Write vulnerability.

These vulnerabilities were first discovered and reported by [Hyunwoo Kim (@v4bel)](https://x.com/v4bel).

What both vulnerabilities have in common is that, on a zero-copy send path where `splice()` plants a reference to a page cache page that the attacker only has read access to into the `frag` slot of the sender side skb as is, the receiver side kernel code performs in-place crypto on top of that frag. As a result, the page cache of files that an unprivileged user only has read access to (such as `/etc/passwd` or `/usr/bin/su`) is modified in RAM, and every subsequent read sees the modified copy.

This article analyzes the root cause and the exploit flow of the two vulnerabilities, and then explains how chaining covers the blind spots of the two vulnerabilities.

# Background

This file has been truncated. show original

init38 · May 10, 2026, 3:36am

Copy.fail / CVE-2026-31431: Linux kernel local privilege escalation vulnerability and help wanted

What users should do

Relation to Kicksecure

Help wanted: reduce SUID attack surface

Further reading

Stay tuned