What is Copy Fail?
CVE-2026-31431 (“Copy Fail”) is a local privilege escalation (LPE) in the Linux kernel crypto/algif_aead subsystem. It was disclosed on 22 April 2026 with a CVSS v3.1 base of 7.8 (High). The bug comes from an in-place encrypt/decrypt optimisation that assumed source and destination buffers could share the same mapping, leading to page-cache corruption and root.
Reported range is roughly kernels 4.14–6.19.11 (plus related 6.12 / 6.18 stable lines)—most kernels shipped from 2017 through April 2026. Ubuntu, Debian, RHEL, AlmaLinux, SUSE and Amazon Linux all published vendor patches.
Why it matters on dedicated, cloud and Kubernetes
- A low-privileged local process (or a compromised app) that can reach an AF_ALG socket may become root.
- Containers share the host kernel; this class of bug can become a container-escape scenario on Docker / Kubernetes.
- On multi-tenant or CI-runner hosts, “user namespaces are enough” is a weak assumption against this CVE.
Patching and interim reduction
- Check your vendor bulletin: Ubuntu USN-8226-1 and follow-ons, Debian linux 6.12.85+, RHEL 8/9/10 RHSA series. Example fixed lines: 5.10.254+, 5.15.204+, 6.1.170+, 6.6.137+, 6.12.85+, 6.18.22+, 6.19.12+.
- Confirm the running kernel with
uname -r; a package update is not enough—you must reboot. - If the patch is delayed, temporarily disabling the relevant crypto/AF_ALG module per vendor guidance can reduce risk; it is not a permanent fix.
- Rebuild third-party kernel modules (NIC, storage, security agents) after the ABI bump.
On KuzeyDC dedicated and cloud Linux servers, kernel patching is the customer’s OS responsibility. Plan the maintenance window, snapshot and reboot order; on unmanaged dedicated, IPMI / KVM remains your console fallback. Track your vendor’s CVE-2026-31431 page and kernel.org stable fixes.