CVE-2026-31431 – Copy Fail (Kernel LPE)

CVE-2026-31431, nicknamed Copy Fail, is a kernel local privilege escalation that allows an unprivileged local user to write four controlled bytes into the page cache of any readable file on a Linux system, and use that to gain root.

Unlike typical kernel exploits, Copy Fail does not depend on precise kernel version offsets, race conditions, or reliable timing. The page cache write primitive bypasses file integrity monitoring since only the in-memory cache is corrupted, not the on-disk content — a similar class of vulnerability to CVE-2022-0847 (Dirty Pipe).

CVSS Vector: CVSS:3 .1/AV:L /AC:L /PR:L /UI:N /S:U /C:H /I:H /A:H

Affected Systems

• Linux kernel versions vulnerable to the copy-fail page cache write primitive
• Any system running an unpatched Linux kernel

Root Cause

A flaw in the kernel’s page cache handling during copy operations allows an attacker to corrupt the in-memory page cache of arbitrary readable files without modifying the underlying storage.

Impact

• Local privilege escalation to root
• Arbitrary file corruption in memory
• Bypass of file integrity monitoring systems
• No system crash on failed exploitation attempts

References

• TryHackMe room: CVE-2026-31431 Copy Fail
• Related: CVE-2022-0847 (Dirty Pipe)

Analysis by Welsh Independent security research & vulnerability analysis