Critical Security Flaw in Linux Discovered with AI Scanning Tools

A significant security vulnerability known as “Copy Fail” has been discovered, affecting nearly every Linux distribution released since 2017. This exploit, identified as CVE-2026-31431, allows any user to elevate their privileges to that of an administrator. The exploit utilizes a Python script that operates seamlessly across all vulnerable distributions, requiring no specific adjustments for different versions or recompilation.

A blog post highlights insights from DevOps engineer Jorijn Schrijvershof, who notes that Copy Fail is particularly dangerous because it can easily evade detection by monitoring tools. He explains that “Page-cache corruption never marks the page dirty,” meaning the kernel’s writeback system doesn’t flush the altered bytes back to disk. Consequently, tools like AIDE, Tripwire, and OSSEC, which rely on on-disk checksums, fail to detect any anomalies.

Theori’s researchers discovered Copy Fail with the help of their Xint Code AI tool. In a blog post, Taeyang Lee shared that he focused on the crypto subsystem of Linux and crafted a prompt that enabled an automated scan, uncovering several vulnerabilities in roughly an hour.

> “This is the linux crypto/ subsystem. Please examine all codepaths reachable from userspace syscalls. Note one key observation: splice() can deliver page-cache references of read-only files (including setuid binaries) to crypto TX scatterlists.”

A patch for Copy Fail was integrated into the mainline Linux kernel on April 1st. However, as noted, the researchers disclosed the exploit’s details before all affected distributions could roll out their patches. While some distributions, such as Arch Linux, RedHat Fedora, and Amazon Linux, have implemented fixes, many others have yet to address the vulnerability.