Copy Fail: The New "Dirty Pipe" Haunting the Linux Kernel (CVE-2026-31431)

1. What is Copy Fail (CVE-2026-31431)?
Copy Fail is a logic flaw in the Linux kernel's crypto-subsystem (specifically the algif_aead module). It allows an unprivileged user to gain full root access in seconds.  

Root Cause: A performance optimization introduced in 2017 allowed the kernel to perform in-place cryptographic operations (reusing the same memory for input and output).  

Flaw: By using the splice() system call, an attacker can trick the kernel into using the Page Cache (the kernel’s in-memory copy of files) as a writable buffer.

Result: An attacker can perform a controlled 4-byte write into any readable file in memory. They typically target a binary like /usr/bin/su to change its logic on the fly and grant themselves root privileges without ever touching the actual file on the disk.
 
2. Why it’s Critical for Cloud & Kubernetes
This is particularly dangerous for multi-tenant environments:
Container Breakout: Because the Page Cache is shared across the entire host kernel, a user in one container can corrupt a file that affects the host and all other containers on that node.  

Reliability: Unlike many exploits that rely on race conditions (timing luck), Copy Fail is deterministic. It works every time, regardless of system speed or load.  

Small Footprint: The exploit can be triggered by a script as small as 732 bytes.
        
3.High-Level Comparison: 
Copy Fail vs. Dirty Pipe If your stakeholders remember Dirty Pipe (2022), this is its modern sibling.  
Feature                   Dirty Pipe (CVE-2022-0847)      Copy Fail (CVE-2026-31431)
SubsystemPipe      Buffer / Splice                                Crypto API / Splice
Trigger                    Uninitialized pipe flags                AEAD in-place logic flaw
Scope                       Linux Kernels 5.8+                       Every major distro since 2017
Detection               Moderate (File modifications)    Difficult (Direct Memory corruption)