Linux Kernel 0-Day “Copy Fail” Grants Root Access Across Major Distros Since 2017

Security researchers disclosed CVE-2026-31431 "Copy Fail", a deterministic Linux kernel local privilege escalation in the cryptographic subsystem that lets unprivileged users perform a controlled four-byte overwrite to in-memory page cache—potentially achieving immediate root and enabling container escapes; the flaw affects kernels since 4.14 across major distributions and has been patched in recent releases, with a temporary mitigation available by blocking algif_aead.