Severe security flaw in the operating system that powers most Internet servers — which an AI found in an hour
Xint Code, an “AI hacker” from security firm Theori, helped uncover a high-severity Linux kernel vulnerability that could have allowed attackers to gain a root shell.
The flaw, named Copy Fail and tracked as CVE-2026-31431, affects mainstream Linux distributions using kernels built since a 2017 kernel change.
Linux underpins most Internet server infrastructure, including web servers, cloud platforms, hosting environments, CI systems, and container clusters.
Theori said the vulnerability was found after researcher Taeyang Lee (pictured, far right) had the key insight that there was an underexplored bug class in a specific area of Linux’s crypto subsystem.
“From there, Xint Code scaled the audit across the entire crypto subsystem in roughly an hour. Copy Fail was the highest-severity finding in the run,” Theori stated.
Theori said the same scan also identified other high-severity bugs, including another privilege escalation vulnerability, which remain under coordinated disclosure.
Copy Fail is a local privilege escalation (LPE) vulnerability, meaning it does not directly let someone attack a server over the Internet.
However, it becomes serious when an attacker already has limited code execution, a stolen low-privilege account, or access to a shared compute environment.
In that scenario, the bug could allow ordinary users to gain root access, giving the attacker administrator-level control over the affected Linux system.
Xint’s proof-of-concept targeted the ‘su’ program, a common setuid-root utility used to switch users, including to the root user, on Linux systems.
Setuid-root programs run with elevated privileges by design, which makes them valuable targets when an attacker can influence what the kernel executes.
The researchers said their 732-byte Python proof-of-concept obtained root shells on Ubuntu, Amazon Linux, Red Hat Enterprise Linux, and SUSE test systems.
They also said that, under the right conditions, because the page cache is shared across the host, an attack could escape container boundaries.
That makes Copy Fail relevant to services like Kubernetes clusters. Theori said that the second part of its technical write-up detailing Kubernetes container escape was forthcoming.
One attack for multiple Linux versions
Although Linux has had major privilege escalation vulnerabilities before, many required precise timing, repeated attempts, or version-specific exploit adjustments.
Copy Fail is different because it is a deterministic logic flaw rather than a race condition or a memory corruption bug needing custom offsets.
Theori described it as a “straight-line logic flaw”, meaning the exploit follows a predictable execution path without needing to win a timing window.
The practical result is portability: Theori said the same short Python script worked across all the distributions they tested without per-kernel tuning.
“The same 732-byte Python script roots every Linux distribution shipped since 2017,” Theori stated.
Theori explained that a 2017 optimisation created the vulnerability, which has gone undetected ever since.
The bug is also notable because the vulnerable feature is enabled by default in mainstream Linux distributions, and the exploit does not require kernel debugging to be turned on.
According to Theori’s disclosure timeline, it reported the vulnerability to the Linux kernel security team on 23 March 2026 and received acknowledgement the following day.
By 25 March, patches were proposed and reviewed, and by 1 April, a patch was committed to the mainline Linux kernel. The patch has already rolled out to major Linux distributions.
“If you run multi-tenant Linux, shared-kernel containers, CI runners that execute untrusted code, or anything where someone you don’t fully trust can ‘execve’ as a regular user — patch,” Theori said.
“Single-user laptop with full-disk encryption and a locked screen — far less urgent. Patch anyway.”
Loading ...