Copy Fail (CVE-2026-31431): How to Patch This Critical Vulnerability on Ubuntu and AlmaLinux (Cheat Sheet PDF)
🚨 CRITICAL SECURITY ALERT: The Copy Fail vulnerability allows for near-instantaneous local privilege escalation (LPE). It is imperative to apply patches or mitigation measures to your production servers immediately.
⚡ Quick Answer
The Copy Fail flaw (CVE-2026-31431) is a critical vulnerability affecting file management on Linux (Ubuntu, AlmaLinux). It allows for memory corruption during massive copy operations, which can lead to privilege escalation. The fix requires an immediate update of the coreutils package and the Linux kernel.
Fluke 323 Digital Clamp Meter (True RMS, 400A AC)
🛠️ The essential tool for this project.
What is the “Copy Fail” flaw (CVE-2026-31431)?
Revealed in late April 2026, Copy Fail (CVE-2026-31431) is a local privilege escalation vulnerability affecting the Linux kernel. Present in the majority of major distributions since 2017, this flaw exploits a logical defect in the kernel’s cryptographic subsystem (the algif_aead module of the AF_ALG API).
The Impact: An attacker with simple user access can trigger a deterministic 4-byte write into the page cache (RAM) of any readable file. By targeting a critical setuid binary (such as /usr/bin/su), the attacker can grant themselves root rights in seconds.
Absolute Stealth: The malicious write only occurs in RAM. The file on the hard drive is never altered. Direct consequence: standard file integrity tools (such as Tripwire or AIDE) based on checksums will not detect any modification. Furthermore, as the page cache is shared between the host and containers, this flaw allows for Container Escapes.
🛡️ Security Commands Cheat Sheet (PDF)
Save time during interventions on your server fleets. Download our PDF cheat sheet listing all mitigation and verification commands for CentOS, AlmaLinux, Ubuntu, and Debian.
How to patch Copy Fail on Ubuntu
On Ubuntu (24.04 LTS, 22.04 LTS, and 20.04 LTS), Canonical responded quickly by publishing emergency mitigation via an update to the kmod package (advisories USN-8226-1 and USN-8226-2). This update automatically blocks the loading of the vulnerable module.
Ubuntu update procedure:
sudo apt update
sudo apt upgrade
# A reboot is strongly recommended to clear memory caches
sudo rebootHow to patch Copy Fail on AlmaLinux
For Enterprise Linux systems, AlmaLinux was the first to deploy patched kernels (versions 8, 9, and 10) starting May 1st, 2026, even ahead of upstream RHEL.
AlmaLinux update procedure:
sudo dnf clean metadata
sudo dnf upgrade
# A reboot is mandatory to load the new kernel
sudo rebootNote: Ensure you are on at least kernel version 4.18.0-553.121.1.el8_10 (AlmaLinux 8), 5.14.0-611.49.2.el9_7 (AlmaLinux 9), or 6.12.0-124.52.2.el10_1 (AlmaLinux 10).
Emergency Mitigation Measures
If you cannot update your kernel or restart your production servers immediately, you must apply temporary mitigation by disabling (blacklisting) the algif_aead module.
# 1. Blacklist the module
echo "install algif_aead /bin/false" | sudo tee /etc/modprobe.d/disable-algif.conf
# 2. Unload the module if it is already in memory
sudo rmmod algif_aead
# 3. PURGE THE PAGE CACHE (CRITICAL!)
# If the system has already been attacked, corruption persists in RAM.
sudo sysctl -w vm.drop_caches=3To verify that the module is no longer active, run lsmod | grep algif_aead. If the command returns nothing, the immediate attack surface is closed.
