CVE ID: CVE-2026-31431
Severity: Critical
Overview:
"Copy Fail" is a logic flaw in the Linux kernel’s cryptographic subsystem. It allows a standard user to overwrite 4 bytes of data in the system's memory cache. While 4 bytes sounds small, it is enough to trick the system into granting root access without ever changing a file on the disk.
Affected Systems:
- Ubuntu 24.04 and earlier
- AlmaLinux / RHEL 8, 9, 10
- Debian 11/12
Immediate Mitigation One-Liner:
Run the following command as root to block the vulnerable module and clear the memory cache:
Bash
echo "blacklist algif_aead" | sudo tee /etc/modprobe.d/copyfail.conf && sudo rmmod algif_aead 2>/dev/null; sudo sync; sudo echo 3 > /proc/sys/vm/drop_caches
