FlagThis

Abstract

CVE-2026-31431, known as "Copy Fail," is a critical local privilege escalation vulnerability in the Linux kernel's `AF_ALG` cryptographic subsystem affecting major distributions running kernels released since 2017. The flaw allows unprivileged users to gain full root access and escape containers in Kubernetes environments by exploiting a logic error in the kernel's page cache. Because the exploit modifies the in-memory page cache rather than the on-disk files, it is difficult to detect using traditional file integrity monitoring tools.