The IT Nerd

If you run Linux, you might want to pay attention to CVE-2026-98432. This is a critical Linux vulnerability that could allow remote attackers to take control of affected systems, is raising an important question for manufacturers of connected devices and industrial equipment: How do you protect products when you don’t necessarily know what’s running inside them?

Joshua Marpet, Sr. Product Security Consultant, Finite State:

“This is a significantly bad problem. This is a problem effectively anybody could take control of a Linux system that’s affected by this. And of course, that’s horribly bad.

“Assume a system which is taking readings from a power plant. Now you can’t trust those readings. And you may not even know that.

“Assume a system that controls a power plant. Now that system could be under hostile control. And you may not even know that you’re vulnerable.

“Because unless a manufacturer is tracking all of the code that they’ve ever written, and all of the versions of the firmware that they’ve ever written, with proper software bills of materials (SBOMs), and proper cryptographic bills of materials (CBOMs), and they’re tracking all of the potential threats and vulnerabilities (threat intelligence), they may never hear about the vulnerability, and they may never be able to tie the vulnerability to an older version of firmware that 100s of clients may still be running.

“And remember a manufacturer doesn’t really get paid to do all of these things with SBOMs and CBOMs and threat intelligence. They get paid to sell devices.

“So a lot of manufacturers never set these systems up to alert them to these problems.

“And realize there’s also a scale issue here. There’s a lot of manufacturers that have 50 people 100 people 150 people. There’s a lot of manufacturers that are still effectively small to medium business.  They may not even understand that they need to have threat intelligence, SBOMs, CBOMs. They may have no way to track which version of firmware clients are using to make sure that they’re updated properly.

“That’s just one side of this.

“Now let’s talk about the Linux side. Since this is a networking bug, Ubuntu hasn’t even decided to fix it. Last I checked, they hadn’t planned to.

“So now you’ve got something that is a bug in an underlying piece of software, the operating system. This isn’t in the application that company XYZ wrote to run on top of it. Are they even tracking that?

“This is a huge bug and vulnerability that’s falling through the cracks. This is a monstrous threat in an industry where threat in intelligence is not universally deployed. Or even close.

“Whose responsibility is it? If this was a cloud environment, there’s a shared responsibility model that clearly lays that out.  With connected devices oftentimes that’s not elucidated properly.

This is one where some people can patch their way out of this. But other people who run Linux who do not know that they run Linux, this is a real problem. And one that relies on the vendors to do the right thing. If they care.

Yesterday, Theori disclosed CVE-2026-31431, dubbed Copy Fail, a Linux kernel vulnerability that allows any unprivileged local user to gain root access on virtually every major Linux distribution shipped since 2017.

In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead – Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.

Uzair Gadit, CEO and Founder of Secure.com, offers perspective and advice:

    “The exploit is a fairly simple 732-byte Python script. The implications are far more significant than another critical CVE, because if your kernel was built between 2017 and the patch, you’re in scope, which likely covers essentially every mainstream Linux distribution.

    “The risk is highest in any environments where namespace isolation (which containers provide) is assumed to be sufficient to protect tenants from one another. The boundaries that hold are the ones that don’t share a kernel. For example, AWS Lambda and Fargate run on Firecracker microVMs, with separate kernels per tenant and no shared page cache. Cloudflare Workers run on V8 isolates, with no Linux kernel in the threat model at all. gVisor interposes a user-space kernel that does not share the host’s algif_aead.

   “That said, development infrastructures, cloud and containerization, CI/CD pipelines and serverless and sandboxing environments are all at risk.

   “What matters even more than the vulnerability itself is how it was found. An AI system discovered a nine-year-old logic flaw in just about an hour.

    “Affected organizations should immediately patch their kernel. The official fix (commit a664bf3d603d) reverts algif_aead.c to out-of-place AEAD operation, permanently separating the TX scatterlist (which may contain page cache pages) from the RX scatterlist (the user’s output buffer).

The patch should be immediately done through the distribution’s update channel, including

·         Ubuntu: kernel security updates

·         RHEL: RHSA advisories

·         SUSE: SUSE Security Updates

·         Amazon Linux: Amazon Linux Security Center

    “Any organization that cannot patch immediately should disable the vulnerable module.”

Ryan McCurdy, VP, Liquibase:

What makes Copy Fail different is not just the bug itself, it is the combination of reach and discovery speed. The disclosure suggests a single short Python script can turn a normal local user into root across a wide range of Linux systems shipped since 2017, including environments like CI runners and container hosts that many organizations rely on every day. The other wake-up call is how it was found. If AI-assisted tooling can surface a bug like this in about an hour, the gap between unknown vulnerability and practical exploit is shrinking fast. That means the real challenge is no longer just finding flaws. It is whether enterprises can patch, isolate, and reduce blast radius quickly enough when vulnerability discovery starts moving at machine speed. “

Noelle Murata, Chief Operating Officer, Xcape, Inc.:

    “Paste Tense: From Clipboard Tricks to Kernel Root

   “Copy Fail is a critical logic flaw in the Linux page cache that lets an unprivileged user gain root access with a simple script. Please patch this across the fleet immediately. While the name originally poked fun at terminal pastejacking, the 2026 reality is a high-severity Local Privilege Escalation (LPE) that breaks fundamental memory isolation by tricking the kernel into mismanaging file-backed pages. This is a silent threat because it requires no complex heap grooming or Return-Oriented Programming (ROP) chains, making it highly reliable for attackers who have already gained a foothold via web shells or compromised containers. Beyond the kernel patch, security leaders should treat this as a catalyst to audit terminal configurations for Bracketed Paste Mode, which serves as a secondary defense against older clipboard-injection-style Copy Fail attacks. Prioritize updates for public-facing Linux servers and developer workstations, as these are the primary targets for the initial access required to trigger this exploit.

   “Because apparently, in 2026, even “control-C” is a high-risk activity.”

Rajeev Raghunarayan, Head of GTM at Averlon:

“Copy Fail is notable because it turns a local Linux kernel issue into a broadly portable privilege-escalation primitive. A small, reliable exploit that works across major distributions without race conditions, user interaction, or heavy customization makes it much easier to operationalize at scale.

“The real risk shows up in shared environments. In Kubernetes clusters, CI pipelines, and other systems running untrusted code, a local privilege escalation can become a stepping stone to compromising the underlying host or moving beyond the initial workload. That’s what makes this more than just another kernel CVE. Organizations should prioritize patching and, where that’s not immediately possible, restrict access to the affected kernel interfaces, especially in shared and containerized environments.”

Jacob Krell, Senior Director, Secure AI Solutions and Cybersecurity, Suzu Labs:

”Copy Fail is qualitatively different from the steady stream of Linux kernel privilege escalation disclosures. Most LPEs require a race condition, a narrow kernel version, or complex heap grooming. This one needs none of that. Theori demonstrated a 732-byte Python exploit with no external dependencies that reliably gains root on major distributions running affected kernels shipped since 2017. The exposed surface is the kernel crypto API, specifically AF_ALG and algif_aead, enabled by default in most environments and rarely treated by enterprises as meaningful attack surface. Any environment where untrusted users or workloads share a kernel, whether container clusters, CI runners, or multi-tenant hosts, should treat this as urgent. Once local code execution becomes root, container and host level isolation assumptions degrade quickly.

“The discovery method matters as much as the vulnerability itself. Theori reports that AI assisted tooling surfaced the flaw in roughly an hour of scanning against the Linux crypto subsystem. That is the real signal. Vulnerability research is entering a wild west era where discovery cycles are shorter, exploit development friction is lower, and the volume of high impact findings will outpace most organizations’ capacity to remediate. Defenders should expect the interval between “unknown,” “public,” and “weaponized” to keep compressing.”

If you run LINUX on any scale, you should be taking action ASAP. This website goes into the weeds and offers very good guidance on what you need to do.