Post

Ryan Munz
@ryanmunz.com

copy.fail Funny thing about copy/fail. The *default* kernel in al2023 (Amazon Linux) is based on 6.1 and is not susceptible to this (tested the poc in a virtual machine). However most "optimized" images (like the EKS ones) are using kernel6.12 which is. I believe there's a kernel6.15 as well.

copy.failCopy Fail — 732 Bytes to RootCVE-2026-31431. 100% Reliable Linux LPE — no race, no per-distro offsets, page-cache write that bypasses on-disk file-integrity tools and crosses containers. Found by Xint Code.
Ryan Munz
@ryanmunz.com

Also the non-rc versions of 7.x have mitigations in place (so Ubuntu 26.04, CachyOS, and very up to date Proxmox). Until they have the kernel patch ready, Ubuntu 24.04 has been mitigating with a kmod patch (I took their modprobe approach and applied it to my proxmox since I'm paranoid).

0 reposts2 likes

No replies yet.