Copy Fail, The Nine-Year Linux Kernel Flaw That Gives Any User Root in Seconds

Devteam · May 2, 2026, 1:17pm

Copy Fail is a trivially exploitable logic bug in Linux, reachable on all major distros released in the last 9 years. A small, portable python script gets root on all platforms.

Devteam · May 2, 2026, 1:23pm

github.com/Cybereason-Public/owLSM

Rules/RuleExamples/ExploitsMitigations/CopyFail-CVE-2026-31431/README.md

main

# Copy Fail (CVE-2026-31431) mitigation with owLSM

Copy Fail is a logic bug in the Linux kernel.
It allows an unprivileged local user to perform a controlled 4-byte write directly into the kernel's page cache of any readable file — including SUID binaries.
Because the page cache is what the kernel reads when executing a file, the corrupted in-memory version runs immediately, while the on-disk file stays unchanged and passes any disk-based integrity check.  
Full write-up: https://xint.io/blog/copy-fail-linux-distributions


## First step — monitoring Copy Fail

In order to understand what rule to write, we run owLSM without any config so it's in "observability only" mode, exploit the vulnerability, and look for an anomaly in the events.

```bash
sudo ./owlsm > events.log
```

After running the exploit as an unprivileged user (`uid=1004`) and searching through the events, we find the execution of `su` — but something is wrong:

```json
{

This file has been truncated. show original