Jump to main content

Quicklinks

Vulnerability CVE-2026-31431 ("Copy Fail")

With CVE-2026-31431, a security-critical vulnerability in the Linux kernel became publicly known at the end of April 2026. The vulnerability ("CopyFail") affects memory processing in the kernel and can, under certain circumstances, lead to root privileges being obtained, even if there is only access to a user without extended authorizations. This also affects SSH-logins. When the vulnerability became known, all common Linux distributions were affected.

Affected systems

  • Linux systems with vulnerable kernel versions

As the specific vulnerability depends heavily on the kernel version and distribution, administrators should check the respective security advisories.

Non-affected systems

On systems with SELinux active in enforcing mode, the vulnerability cannot be exploited. Once available, updates should be applied on these systems nonetheless.

Risk

  • Local privilege escalation possible if there is access to any local account (also via SSH!)
  • Potential system compromise if successfully exploited
  • Particularly critical on multi-user systems or systems with untrusted code execution

Measures

  • Update the kernel promptly as soon as security updates are available. This is already the case for individual distributions such as Debian.
  • If an updated kernel is not yet available, consider temporarily deactivating the algif_aead kernel module. Follow the recommended mitigation measures of your Linux distribution (see links below).
  • If none of the aforementioned mitigation measures can be implemented for your system:
    • Restrict access to systems (especially SSH access)
    • Increase monitoring for unusual activities

A system restart is required after a kernel update.

Information from the distributions

Please check the official notes of your distribution:

Further information